2407 matches found
USN-7181-1: Salt vulnerability
It was discovered that Salt incorrectly handled web requests when the SSH client was enabled. An attacker could possibly use this issue to achieve remote code execution or obtain sensitive information...
USN-7181-1 salt vulnerability
It was discovered that Salt incorrectly handled web requests when the SSH client was enabled. An attacker could possibly use this issue to achieve remote code execution or obtain sensitive information...
Ubuntu 14.04 LTS : Salt vulnerability (USN-7181-1)
The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7181-1 advisory. It was discovered that Salt incorrectly handled web requests when the SSH client was enabled. An attacker could possibly use this issue to achieve remote code...
PT-2025-25396
Name of the Vulnerable Software and Affected Versions Salt Master affected versions not specified Description The issue arises when the VirtKey class is called upon requesting "on-demand pillar" data. It utilizes un-validated input to create paths to the "pki directory". This functionality is use...
PT-2025-25394
Name of the Vulnerable Software and Affected Versions Salt Master affected versions not specified Description The issue allows arbitrary event injection on the Salt Master. An authorized minion can use the master's minion event method to send arbitrary events onto the master's event bus...
PT-2025-25391
Name of the Vulnerable Software and Affected Versions SaltStack Salt versions 3007.0 and later Description The issue concerns an authorization bypass in the Minion event bus. An attacker with access to a minion key can craft a message to potentially execute a job on other minions. Recommendations...
PT-2025-25393
Name of the Vulnerable Software and Affected Versions SaltStack Salt affected versions not specified Description The issue concerns a directory traversal attack in minion file cache creation. The master's default cache is vulnerable to this attack, which could be leveraged to write or overwrite...
PT-2025-25388
Name of the Vulnerable Software and Affected Versions Salt versions affected versions not specified Description The issue concerns the salt.auth.pki module, which does not properly authenticate callers. The module validates a public certificate in the password field against a CA certificate, but...
Salt Typhoon’s Reach Continues to Grow
The US government has identified a ninth telecom that was successfully hacked by Salt Typhoon...
The vulnerability of the salt-call command in the configuration management system and remote execution of Salt operations allows a attacker to trigger a service failure.
The vulnerability of configuration management systems and remote execution of operations related to Salt is related to insufficient validation of input data in the columns. Exploiting this vulnerability can allow a malicious actor to cause service failures...
php: Password_verify() always return true with some hash
A vulnerability was found in PHP. This security flaw occurs when malformatted BCrypt hashes that include a $ within their salt part trigger a buffer overread and may erroneously validate any password as valid...
ROS-20241209-05
The vulnerability of Salt's configuration management and remote execution system is related to the fact that the application does not cause a crash when bad column data is detected. Exploitation of the vulnerability could allow an attacker acting remotely to use the default value from state inste...
GLSA-202412-09 : Salt: Multiple Vulnerabilities
The remote host is affected by the vulnerability described in GLSA-202412-09 Salt: Multiple Vulnerabilities Multiple vulnerabilities have been discovered in Salt. Please review the CVE identifiers referenced below for details. Tenable has extracted the preceding description block directly from th...
Salt: Multiple Vulnerabilities
Background Salt is a fast, intelligent and scalable automation engine. Description Multiple vulnerabilities have been discovered in Salt. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no known...
Senators Warn the Pentagon: Get a Handle on China’s Telecom Hacking
In a letter to the Department of Defense, senators Ron Wyden and Eric Schmitt are calling for an investigation into fallout from the Salt Typhoon espionage campaign...
Joint Advisory Warns of PRC-Backed Cyber Espionage Targeting Telecom Networks
A joint advisory issued by Australia, Canada, New Zealand, and the U.S. has warned of a broad cyber espionage campaign undertaken by People's Republic of China PRC-affiliated threat actors targeting telecommunications providers. "Identified exploitations or compromises associated with these threa...
THN Recap: Top Cybersecurity Threats, Tools and Tips (Nov 25 - Dec 1)
Ever wonder what happens in the digital world every time you blink? Here's something wild - hackers launch about 2,200 attacks every single day, which means someone's trying to break into a system somewhere every 39 seconds. And get this - while we're all worried about regular hackers, there are...
Astra Linux – Vulnerability in LibreOffice
A out-of-bounds write vulnerability exists in The Document Foundation LibreOffice due to crafted OOXML documents with mismatched encryption salt parameters. This issue affects LibreOffice versions starting from 26.2 before 26.2.3, and also versions starting from 25.8 before 25.8.7...
Chinese Hackers Exploit T-Mobile and Other U.S. Telecoms in Broader Espionage Campaign
U.S. telecoms giant T-Mobile has confirmed that it was also among the companies that were targeted by Chinese threat actors to gain access to valuable information. The adversaries, tracked as Salt Typhoon, breached the company as part of a "monthslong campaign" designed to harvest cellphone...
