Vulnerabilities > Saltstack

DATE CVE VULNERABILITY TITLE RISK
2020-11-06 CVE-2020-25592 Improper Input Validation vulnerability in Saltstack Salt
In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens.
network
low complexity
saltstack CWE-20
7.5
2020-11-06 CVE-2020-17490 Incorrect Permission Assignment for Critical Resource vulnerability in Saltstack Salt
The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions.
local
low complexity
saltstack CWE-732
2.1
2020-11-06 CVE-2020-16846 Unspecified vulnerability in Saltstack Salt
An issue was discovered in SaltStack Salt through 3002.
network
low complexity
saltstack
7.5
2020-04-30 CVE-2020-11652 Improper Input Validation vulnerability in multiple products
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2.
network
low complexity
saltstack debian opensuse CWE-20
4.0
2020-04-30 CVE-2020-11651 Improper Input Validation vulnerability in multiple products
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2.
network
low complexity
saltstack debian opensuse CWE-20
7.5
2020-01-17 CVE-2019-17361 Command Injection vulnerability in multiple products
In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection.
6.8
2019-12-03 CVE-2013-2228 Improper Restriction of Excessive Authentication Attempts vulnerability in Saltstack 0.14.0/0.14.1/0.15.0
SaltStack RSA Key Generation allows remote users to decrypt communications
network
saltstack CWE-307
4.3
2019-07-18 CVE-2019-1010259 SQL Injection vulnerability in Saltstack Salt 2018 and Salt 2019
SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection.
network
low complexity
saltstack CWE-89
7.5
2018-10-24 CVE-2018-15751 Improper Authentication vulnerability in Saltstack Salt
SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass authentication and execute arbitrary commands via salt-api(netapi).
network
low complexity
saltstack CWE-287
7.5
2018-10-24 CVE-2018-15750 Path Traversal vulnerability in Saltstack Salt
Directory Traversal vulnerability in salt-api in SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allows remote attackers to determine which files exist on the server.
network
low complexity
saltstack CWE-22
5.0