Vulnerabilities > Saltstack
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2017-08-09 | CVE-2015-6941 | DEPRECATED: Information Exposure Through Debug Log Files vulnerability in Saltstack Salt 2015 win_useradd, salt-cloud and the Linode driver in salt 2015.5.x before 2015.5.6, and 2015.8.x before 2015.8.1 leak password information in debug logs. | 9.8 |
| 2017-04-25 | CVE-2017-8109 | Information Exposure vulnerability in Saltstack Salt The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions (clients). | 7.8 |
| 2017-04-13 | CVE-2015-1839 | Data Processing Errors vulnerability in multiple products modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp. | 5.3 |
| 2017-04-13 | CVE-2015-1838 | Data Processing Errors vulnerability in multiple products modules/serverdensity_device.py in SaltStack before 2014.7.4 does not properly handle files in /tmp. | 5.3 |
| 2017-02-07 | CVE-2016-9639 | Improper Access Control vulnerability in Saltstack Salt Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching. | 9.1 |
| 2017-01-31 | CVE-2016-3176 | Improper Authentication vulnerability in Saltstack Salt Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured authentication service by passing an alternate service with a command sent to LocalClient. | 5.6 |
| 2017-01-30 | CVE-2015-8034 | Information Exposure vulnerability in Saltstack Salt The state.sls function in Salt before 2015.8.3 uses weak permissions on the cache data, which allows local users to obtain sensitive information by reading the file. | 3.3 |
| 2016-04-12 | CVE-2016-1866 | Improper Access Control vulnerability in multiple products Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle attackers to execute arbitrary code by inserting packets into the minion-master data stream. | 8.1 |