Page 7 of 47 results (0.008 seconds)

CVSS: 9.0EPSS: 0%CPEs: 9EXPL: 0

Salt-api in SaltStack Salt before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2 allows arbitrary command execution on a salt-master via Salt's ssh_client. salt-api en SaltStack Salt en versiones anteriores a la 2015.8.13, las versiones 2016.3.x anteriores a 2016.3.5 y las versiones 2016.11.x anteriores a 2016.11.2 permite la ejecución arbitraria de comandos en un salt_master mediante el ssh_client de Salt. • https://docs.saltstack.com/en/2016.3/topics/releases/2015.8.13.html https://docs.saltstack.com/en/2016.3/topics/releases/2016.3.5.html https://docs.saltstack.com/en/latest/topics/releases/2016.11.2.html •

CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0

Salt before 2014.7.6 does not verify certificates when connecting via the aliyun, proxmox, and splunk modules. Salt en versiones anteriores a la 2014.7.6 no verifica los certificados cuando se conecta mediante los módulos aliyun, proxmox y splunk. • http://www.openwall.com/lists/oss-security/2015/05/19/2 https://bugzilla.redhat.com/show_bug.cgi?id=1222960 https://docs.saltstack.com/en/latest/topics/releases/2014.7.6.html https://groups.google.com/forum/#%21topic/salt-users/8Kv1bytGD6c • CWE-295: Improper Certificate Validation •

CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0

Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.11.7 and 2017.7.x before 2017.7.1 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. Una vulnerabilidad de salto de directorio en la validación minion id en SaltStack Salt en versiones anteriores a la 2016.11.7 y 2017.7.x en versiones anteriores a la 2017.7.1 permite que minions remotos con credenciales incorrectas se autentiquen en un master mediante un ID minion manipulado. • http://www.securityfocus.com/bid/100384 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=872399 https://bugzilla.redhat.com/show_bug.cgi?id=1482006 https://docs.saltstack.com/en/2016.11/topics/releases/2016.11.7.html https://docs.saltstack.com/en/latest/topics/releases/2017.7.1.html https://github.com/saltstack/salt/pull/42944 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 7.8EPSS: 0%CPEs: 7EXPL: 0

The salt-ssh minion code in SaltStack Salt 2016.11 before 2016.11.4 copied over configuration from the Salt Master without adjusting permissions, which might leak credentials to local attackers on configured minions (clients). En las versiones anteriores a la 2016.11.4 de Salt 2016.11 el código salt-ssh esta copiado sobre la configuración de Salt Master sin ajustar convenientemente los permisos, lo que permitiría filtrar credenciales a atacantes locales en minions (clientes) configurados. • http://www.securityfocus.com/bid/98095 https://bugzilla.suse.com/show_bug.cgi?id=1035912 https://docs.saltstack.com/en/latest/topics/releases/2016.11.4.html https://github.com/saltstack/salt/issues/40075 https://github.com/saltstack/salt/pull/40609 https://github.com/saltstack/salt/pull/40609/commits/6e34c2b5e5e849302af7ccd00509929c3809c658 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0

modules/serverdensity_device.py in SaltStack before 2014.7.4 does not properly handle files in /tmp. modules/serverdensity_device.py en SaltStack en versiones anteriores a 2014.7.4 no maneja correctamente archivos en /tmp. • http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175568.html https://bugzilla.redhat.com/show_bug.cgi?id=1212784 https://docs.saltstack.com/en/latest/topics/releases/2014.7.4.html https://github.com/saltstack/salt/commit/e11298d7155e9982749483ca5538e46090caef9c • CWE-19: Data Processing Errors •