Vulnerabilities > Saltstack
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-11-06 | CVE-2020-25592 | Improper Input Validation vulnerability in Saltstack Salt In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. | 7.5 |
| 2020-11-06 | CVE-2020-17490 | Incorrect Permission Assignment for Critical Resource vulnerability in Saltstack Salt The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions. | 2.1 |
| 2020-11-06 | CVE-2020-16846 | Unspecified vulnerability in Saltstack Salt An issue was discovered in SaltStack Salt through 3002. | 7.5 |
| 2020-04-30 | CVE-2020-11652 | Improper Input Validation vulnerability in multiple products An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. | 4.0 |
| 2020-04-30 | CVE-2020-11651 | Improper Input Validation vulnerability in multiple products An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. | 7.5 |
| 2020-01-17 | CVE-2019-17361 | Command Injection vulnerability in multiple products In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. | 6.8 |
| 2019-12-03 | CVE-2013-2228 | Improper Restriction of Excessive Authentication Attempts vulnerability in Saltstack 0.14.0/0.14.1/0.15.0 SaltStack RSA Key Generation allows remote users to decrypt communications | 4.3 |
| 2019-07-18 | CVE-2019-1010259 | SQL Injection vulnerability in Saltstack Salt 2018 and Salt 2019 SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection. | 7.5 |
| 2018-10-24 | CVE-2018-15751 | Improper Authentication vulnerability in Saltstack Salt SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass authentication and execute arbitrary commands via salt-api(netapi). | 7.5 |
| 2018-10-24 | CVE-2018-15750 | Path Traversal vulnerability in Saltstack Salt Directory Traversal vulnerability in salt-api in SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allows remote attackers to determine which files exist on the server. | 5.0 |