CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 03/12/2019 |
| CVE-2019-1010259 | 심각9.8 | SaltStack Salt 2018.3, 2019.2 is affected by: SQL Injection. The impact is: An attacker could escalate privileges on MySQL server deployed by cloud provider. It leads to RCE. The component is: The mysql.user_chpass function from the MySQL module for Salt. The attack vector is: specially crafted password string. The fix | 18/07/2019 |
| CVE-2018-15751 | 심각9.8 | SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass authentication and execute arbitrary commands via salt-api(netapi). | 24/10/2018 |
| CVE-2018-15750 | 보통5.3 | Directory Traversal vulnerability in salt-api in SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allows remote attackers to determine which files exist on the server. | 24/10/2018 |
| CVE-2017-7893 | 심각9.8 | In SaltStack Salt before 2016.3.6, compromised salt-minions can impersonate the salt-master. | 23/04/2018 |
| CVE-2017-14696 | 높음7.5 | SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote attackers to cause a denial of service via a crafted authentication request. | 24/10/2017 |
| CVE-2017-14695 | 심각9.8 | Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. NOTE: this vulnerability exists because of an incomplete fix for CV | 24/10/2017 |
| CVE-2015-6918 | 보통6.3 | salt before 2015.5.5 leaks git usernames and passwords to the log. | 10/10/2017 |
| CVE-2017-5200 | 높음8.8 | Salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2 allows arbitrary command execution on a salt-master via Salt's ssh_client. | 26/09/2017 |
| CVE-2017-5192 | 높음8.8 | When using the local_batch client from salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, external authentication is not respected, enabling all authentication to be bypassed. | 26/09/2017 |
| CVE-2015-4017 | 높음7.5 | Salt before 2014.7.6 does not verify certificates when connecting via the aliyun, proxmox, and splunk modules. | 25/08/2017 |
| CVE-2017-12791 | 심각9.8 | Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. | 23/08/2017 |
| CVE-2015-6941 | 심각9.8 | win_useradd, salt-cloud and the Linode driver in salt 2015.5.x before 2015.5.6, and 2015.8.x before 2015.8.1 leak password information in debug logs. | 09/08/2017 |
| CVE-2017-8109 | 높음7.8 | The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions (clients). | 25/04/2017 |
| CVE-2015-1839 | 보통5.3 | modules/chef.py in SaltStack before 2014.7.4 does not properly handle files in /tmp. | 13/04/2017 |
| CVE-2015-1838 | 보통5.3 | modules/serverdensity_device.py in SaltStack before 2014.7.4 does not properly handle files in /tmp. | 13/04/2017 |
| CVE-2016-9639 | 심각9.1 | Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching. | 07/02/2017 |
| CVE-2016-3176 | 보통5.6 | Salt before 2015.5.10 and 2015.8.x before 2015.8.8, when PAM external authentication is enabled, allows attackers to bypass the configured authentication service by passing an alternate service with a command sent to LocalClient. | 31/01/2017 |