Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
199 results · page 2 of 4
Jun 13, 2025The salt.auth.pki module does not properly authenticate callers.CVE-2024-38825 · Other software · VMware · reported by security@vmware.comMedium 6.4
The salt.auth.pki module does not properly authenticate callers. The "password" field contains a public certificate which is validated against a CA certificate by the module. This is not pki authentication, as the caller does not need access to the corresponding private key for the authentication attempt to be accepted.
- Product
- SALT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.saltproject.iodocs.saltproject.io
Jun 13, 2025Salt's request server is vulnerable to replay attacks when not using a TLS encrypted transport.CVE-2024-38823 · Other software · VMware · reported by security@vmware.comLow 2.7
Salt's request server is vulnerable to replay attacks when not using a TLS encrypted transport.
- Product
- SALT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.saltproject.iodocs.saltproject.io
Jun 13, 2025Multiple methods in the salt master skip minion token validation.CVE-2024-38822 · Other software · VMware · reported by security@vmware.comLow 2.7
Multiple methods in the salt master skip minion token validation. Therefore a misbehaving minion can impersonate another minion.
- Product
- SALT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.saltproject.iodocs.saltproject.io
Jun 10, 2025TinySalt: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')CVE-2025-49454 · WordPress plugins & themes · reported by PatchstackHigh 8.1
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LoftOcean TinySalt tinysalt allows PHP Local File Inclusion.This issue affects TinySalt: from n/a through < 3.10.0.
- Product
- TinySalt
- What to do
- Update TinySalt to the newest version.
May 22, 2025One way hash with predictable salt vulnerabilities in ASPECT may expose sensitive information to a potential attackerThis issue affects ASPECT-Enterprise: throuCVE-2024-13951 · Other software · ABB · reported by cybersecurity@ch.abb.comMedium 6.1
One way hash with predictable salt vulnerabilities in ASPECT may expose sensitive information to a potential attackerThis issue affects ASPECT-Enterprise: through 3.*; NEXUS Series: through 3.*; MATRIX Series: through 3.*.
- Product
- ASPECT-Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2025The device’s passwords have not been adequately salted, making them vulnerable to password extraction attacks.CVE-2025-32471 · Other software · SICK AG · reported by psirt@sick.deLow 3.7
The device’s passwords have not been adequately salted, making them vulnerable to password extraction attacks.
- Product
- SICK FLX3-CPUC200
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 2, 2025Crypt::Salt for Perl version 0.01 uses insecure rand() function when generating salts for cryptographic purposes.CVE-2025-1805 · Other software · HACHI · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eMedium 5.3
Crypt::Salt for Perl version 0.01 uses insecure rand() function when generating salts for cryptographic purposes.
- Product
- Crypt::Salt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmetacpan.orgperldoc.perl.org
Mar 26, 2025DBIx::Class::EncodedColumn use the rand() function, which is not cryptographically secure to salt password hashes.CVE-2025-27552 · Other software · WREIS · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eMedium 4
DBIx::Class::EncodedColumn use the rand() function, which is not cryptographically secure to salt password hashes. This vulnerability is associated with program files Crypt/Eksblowfish/Bcrypt.pm. This issue affects DBIx::Class::EncodedColumn until 0.00032.
- Product
- DBIx::Class::EncodedColumn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmetacpan.orgsecurity.metacpan.org
Mar 26, 2025DBIx::Class::EncodedColumn use the rand() function, which is not cryptographically secure to salt password hashes.CVE-2025-27551 · Other software · WREIS · reported by 9b29abf9-4ab0-4765-b253-1875cd9b441eMedium 4
DBIx::Class::EncodedColumn use the rand() function, which is not cryptographically secure to salt password hashes. This vulnerability is associated with program files lib/DBIx/Class/EncodedColumn/Digest.pm. This issue affects DBIx::Class::EncodedColumn until 0.00032.
- Product
- DBIx::Class::EncodedColumn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmetacpan.orgsecurity.metacpan.org
Mar 19, 2025The CozyStay and TinySalt plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.7.0, and in all versions up to, aCVE-2024-13410 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The CozyStay and TinySalt plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.7.0, and in all versions up to, and including 3.9.0, respectively, via deserialization of untrusted input in the 'ajax_handler' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
- Affected
- up to 1.7.0
- What to do
- Affects up to 1.7.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordthemeforest.netthemeforest.net
Mar 9, 2025Improper Certificate Validation (CWE-295) in the Gallagher Command Centre SALTO integration allowed an attacker to spoof the SALTO server.CVE-2024-41724 · Other software · Gallagher · reported by disclosures@gallagher.comHigh 8.7
Improper Certificate Validation (CWE-295) in the Gallagher Command Centre SALTO integration allowed an attacker to spoof the SALTO server. This issue affects all versions of Gallagher Command Centre prior to 9.20.1043.
- Product
- Command Centre Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gallagher.com
Nov 14, 2024The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script.CVE-2023-34049 · Other software · Salt · reported by security@vmware.comMedium 6.7
The Salt-SSH pre-flight option copies the script to the target at a predictable path, which allows an attacker to force Salt-SSH to run their script. If an attacker has access to the target VM and knows the path to the pre-flight script before it runs they can ensure Salt-SSH runs their script with the privileges of the user running Salt-SSH. Do not make the copy path on the target predictable and ensure we check return codes of the scp command if the copy fails.
- Product
- SALT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2024Saltcorn is an extensible, open source, no-code database application builder.CVE-2024-47818 · Other software · saltcorn · reported by GitHubMedium 6.5
Saltcorn is an extensible, open source, no-code database application builder. A logged-in user with any role can delete arbitrary files on the filesystem by calling the `sync/clean_sync_dir` endpoint. The `dir_name` POST parameter is not validated/sanitized and is used to construct the `syncDir` that is deleted by calling `fs.rm`. This issue has been addressed in release version 1.0.0-beta16 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- saltcorn
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 30, 2024Certain switch models from PLANET Technology use an insecure hashing function to hash user passwords without being salted.CVE-2024-8453 · Other software · PLANET Technology · reported by twcert@cert.org.twMedium 4.9
Certain switch models from PLANET Technology use an insecure hashing function to hash user passwords without being salted. Remote attackers with administrator privileges can read configuration files to obtain the hash values, and potentially crack them to retrieve the plaintext passwords.
- Product
- GS-4210-24PL4C hardware 2.0
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Sep 12, 2024The CMP CLI client in KeyFactor EJBCA before 8.3.1 has only 6 octets of salt, and is thus not compliant with the security requirements of RFC 4211, and might maCVE-2024-36066 · Other software · Keyfactor · reported by MITRELow 3.1
The CMP CLI client in KeyFactor EJBCA before 8.3.1 has only 6 octets of salt, and is thus not compliant with the security requirements of RFC 4211, and might make man-in-the-middle attacks easier. CMP includes password-based MAC as one of the options for message integrity and authentication (the other option is certificate-based). RFC 4211 section 4.4 requires that password-based MAC parameters use a salt with a random value of at least 8 octets. This helps to inhibit dictionary attacks. Because the standalone CMP client originally was developed as test code, the salt was instead hardcoded and only 6 octets long.
- Product
- Ejbca
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddatatracker.ietf.orgsupport.keyfactor.com
Aug 29, 2024core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file thaCVE-2024-45440 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 5.3
core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure (even when error logging is None) if the value of hash_salt is file_get_contents of a file that does not exist.
- Product
- Drupal core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsenscybersecurity.nldrupal.org
Jun 27, 2024A specially crafted url can be created which leads to a directory traversal in the salt file server.CVE-2024-22232 · Other software · VMware · reported by security@vmware.comHigh 7.7
A specially crafted url can be created which leads to a directory traversal in the salt file server. A malicious user can read an arbitrary file from a Salt master’s filesystem.
- Product
- Salt Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsaltproject.iosaltproject.io
Jun 27, 2024Syndic cache directory creation is vulnerable to a directory traversal attack in salt project which can lead a malicious attacker to create an arbitrary directoCVE-2024-22231 · Other software · VMware · reported by security@vmware.comMedium 5
Syndic cache directory creation is vulnerable to a directory traversal attack in salt project which can lead a malicious attacker to create an arbitrary directory on a Salt master.
- Product
- Salt Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsaltproject.iosaltproject.io
May 27, 2024RhinOS 3.0-1190 is vulnerable to an XSS via the "tamper" parameter in /admin/lib/phpthumb/phpthumb.php.CVE-2024-5409 · Other software · SaltOS · reported by cve-coordination@incibe.esHigh 7.1
RhinOS 3.0-1190 is vulnerable to an XSS via the "tamper" parameter in /admin/lib/phpthumb/phpthumb.php. An attacker could create a malicious URL and send it to a victim to obtain their session details.
- Product
- RhinOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2024Vulnerability in RhinOS 3.0-1190 consisting of an XSS through the "search" parameter of /portal/search.htm.CVE-2024-5408 · Other software · SaltOS · reported by cve-coordination@incibe.esHigh 7.1
Vulnerability in RhinOS 3.0-1190 consisting of an XSS through the "search" parameter of /portal/search.htm. This vulnerability could allow a remote attacker to steal details of a victim's user session by submitting a specially crafted URL.
- Product
- RhinOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2024A vulnerability in RhinOS 3.0-1190 could allow PHP code injection through the "search" parameter in /portal/search.htm.CVE-2024-5407 · Other software · SaltOS · reported by cve-coordination@incibe.esCritical 10
A vulnerability in RhinOS 3.0-1190 could allow PHP code injection through the "search" parameter in /portal/search.htm. This vulnerability could allow a remote attacker to perform a reverse shell on the remote system, compromising the entire infrastructure.
- Product
- RhinOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2024An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed957fb.CVE-2023-49599 · Other software · WWBN · reported by talos-cna@cisco.comCritical 9.8
An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted series of HTTP requests can lead to privilege escalation. An attacker can gather system information via HTTP requests and brute force the salt offline, leading to forging a legitimate password recovery code for the admin user.
- Product
- AVideo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Sep 12, 2023Xpand IT Write-back manager v2.3.1 uses a hardcoded salt in license class configuration which leads to the generation of a hardcoded and predictable symmetric eCVE-2023-27169 · Other software · Xpand-it · reported by MITREMedium 6.5
Xpand IT Write-back manager v2.3.1 uses a hardcoded salt in license class configuration which leads to the generation of a hardcoded and predictable symmetric encryption keys for license generation and validation.
- Product
- Write-back Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbalwurk.combalwurk.com
Sep 5, 2023Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2.CVE-2023-20898 · Other software · Saltstack · reported by security@vmware.comMedium 4.2
Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 3006.2. Anything that uses Git Providers with different environments can get garbage data or the wrong data, which can lead to wrongful data disclosure, wrongful executions, data corruption and/or crash.
- Product
- Salt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgsaltproject.io
Sep 5, 2023Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return.CVE-2023-20897 · Other software · Saltstack · reported by security@vmware.comMedium 5.3
Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unresponsive to return requests until restarted.
- Product
- Salt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgsaltproject.io
Apr 3, 2023The hashing algorithm of ChurchCRM v4.5.3 utilizes a non-random salt value which allows attackers to use precomputed hash tables or dictionary attacks to crack CVE-2023-26855 · Other software · Churchcrm · reported by MITREHigh 7.5
The hashing algorithm of ChurchCRM v4.5.3 utilizes a non-random salt value which allows attackers to use precomputed hash tables or dictionary attacks to crack the hashed passwords.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 17, 2023Buffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute arbitrary code via the func variable in salt/salt/modules/status.py fileCVE-2021-33226 · Other software · Saltstack · reported by MITRECritical 9.8
Buffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute arbitrary code via the func variable in salt/salt/modules/status.py file. NOTE: this is disputed by third parties because an attacker cannot influence the eval input
- Product
- Salt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comgithub.com
Nov 14, 2022Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 did not use strict comparison for the legacy_salt so that limited authentication bypaCVE-2022-43690 · Other software · Concretecms · reported by MITREMedium 6.3
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 did not use strict comparison for the legacy_salt so that limited authentication bypass could occur if using this functionality. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.
- Product
- Concrete CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.concretecms.orgdocumentation.concretecms.org
Oct 31, 2022The application was vulnerable to an authenticated information disclosure, allowing administrators to view unsalted user passwords, which could lead to the compCVE-2022-40295 · Websites & servers · PHP Point of Sale LLC · reported by vdp@themissinglink.com.auMedium 4.9
The application was vulnerable to an authenticated information disclosure, allowing administrators to view unsalted user passwords, which could lead to the compromise of plaintext passwords via offline attacks.
- Product
- PHP Point of Sale
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthemissinglink.com.authemissinglink.com.au
Jun 23, 2022An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2.CVE-2022-22967 · Other software · Saltstack · reported by security@vmware.comHigh 8.8
An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to reject locked accounts, which allows a previously authorized user whose account is locked still run Salt commands when their account is locked. This affects both local shell accounts with an active session and salt-api users that authenticate via PAM eauth.
- Product
- Salt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrepo.saltproject.iosaltproject.io
Apr 6, 2022A use of a one-way hash with a predictable salt vulnerability [CWE-760] in FortiWAN before 4.5.9 may allow an attacker who has previously come in possession of CVE-2021-26113 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 6.2
A use of a one-way hash with a predictable salt vulnerability [CWE-760] in FortiWAN before 4.5.9 may allow an attacker who has previously come in possession of the password file to potentially guess passwords therein stored.
- Product
- Fortinet FortiWAN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Mar 30, 2022An improper authorization handling flaw was found in Foreman.CVE-2021-3456 · Other software · Theforeman · reported by Red HatHigh 7.1
An improper authorization handling flaw was found in Foreman. The Salt plugin for the smart-proxy allows foreman clients to execute actions that should be limited to the Foreman Server. This flaw allows an authenticated local attacker to access and delete limited resources and also causes a denial of service on the Foreman server. The highest threat from this vulnerability is to integrity and system availability.
- Product
- Smart Proxy Salt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Mar 29, 2022An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1.CVE-2022-22941 · Other software · Saltstack · reported by security@vmware.comHigh 8.8
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Masters, with a publisher_acl, if a user configured in the publisher_acl targets any minion connected to the Syndic, the Salt Master incorrectly interpreted no valid targets as valid, allowing configured users to target any of the minions connected to the syndic with their configured commands. This requires a syndic master combined with publisher_acl configured on the Master-of-Masters, allowing users specified in the publisher_acl to bypass permissions, publishing authorized commands to any configured minion.
- Product
- Salt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comrepo.saltproject.io
Mar 29, 2022An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1.CVE-2022-22936 · Other software · Saltstack · reported by security@vmware.comHigh 8.8
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Job publishes and file server replies are susceptible to replay attacks, which can result in an attacker replaying job publishes causing minions to run old jobs. File server replies can also be re-played. A sufficient craft attacker could gain root access on minion under certain scenarios.
- Product
- Salt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comrepo.saltproject.io
Mar 29, 2022An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1.CVE-2022-22935 · Other software · Saltstack · reported by security@vmware.comLow 3.7
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. A minion authentication denial of service can cause a MiTM attacker to force a minion process to stop by impersonating a master.
- Product
- Salt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comrepo.saltproject.io
Mar 29, 2022An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1.CVE-2022-22934 · Other software · Saltstack · reported by security@vmware.comHigh 8.8
An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attackers substituting arbitrary pillar data.
- Product
- Salt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comrepo.saltproject.io
Jan 21, 2022When a zone file in ldns 1.7.1 is parsed, the function ldns_nsec3_salt_data is too trusted for the length value obtained from the zone file.CVE-2020-19861 · Other software · Nlnetlabs · reported by MITREHigh 7.5
When a zone file in ldns 1.7.1 is parsed, the function ldns_nsec3_salt_data is too trusted for the length value obtained from the zone file. When the memcpy is copied, the 0xfe - ldns_rdf_size(salt_rdf) byte data can be copied, causing heap overflow information leakage.
- Product
- Ldns
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
Dec 7, 2021The devise_masquerade gem before 1.3 allows certain attacks when a password's salt is unknown.CVE-2021-28680 · Other software · Devise Masquerade Project · reported by MITREHigh 8.1
The devise_masquerade gem before 1.3 allows certain attacks when a password's salt is unknown. An application that uses this gem to let administrators masquerade/impersonate users loses one layer of security protection compared to a situation where Devise (without this extension) is used. If the server-side secret_key_base value became publicly known (for instance if it is committed to a public repository by mistake), there are still other protections in place that prevent an attacker from impersonating any user on the site. When masquerading is not used in a plain Devise application, one must know the password salt of the target user if one wants to encrypt and sign a valid session cookie. When devise_masquerade is used, however, an attacker can decide which user the "back" action will go back to without knowing that user's password salt and simply knowing the user ID, by manipulating the session cookie and pretending that a user is already masqueraded by an administrator.
- Product
- Devise Masquerade
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlabanskoller.se
Nov 9, 2021KNX ETS6 through 6.0.0 uses the hard-coded password ETS5Password, with a salt value of Ivan Medvedev, allowing local users to read project information, a similaCVE-2021-43575 · Other software · KNX · reported by MITREMedium 5.5
KNX ETS6 through 6.0.0 uses the hard-coded password ETS5Password, with a salt value of Ivan Medvedev, allowing local users to read project information, a similar issue to CVE-2021-36799. NOTE: The vendor disputes this because it is not the responsibility of the ETS to securely store cryptographic key material when it is not being exported
- Product
- Engineering Tool Software 6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2021An issue was discovered in SaltStack Salt before 3003.3.CVE-2021-22004 · Other software · Saltstack · reported by security@vmware.comMedium 6.4
An issue was discovered in SaltStack Salt before 3003.3. The salt minion installer will accept and use a minion config file at C:\salt\conf if that file is in place before the installer is run. This allows for a malicious actor to subvert the proper behaviour of the given minion software.
- Product
- Salt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Sep 8, 2021An issue was discovered in SaltStack Salt before 3003.3.CVE-2021-21996 · Other software · Saltstack · reported by security@vmware.comHigh 7.5
An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and source_hash URLs can gain full file system access as root on a salt minion.
- Product
- Salt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orglists.debian.org
Aug 4, 2021A use of one-way hash with a predictable salt vulnerability in the password storing mechanism of FortiPortal 6.0.0 through 6.04 may allow an attacker already inCVE-2021-32596 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 6
A use of one-way hash with a predictable salt vulnerability in the password storing mechanism of FortiPortal 6.0.0 through 6.04 may allow an attacker already in possession of the password store to decrypt the passwords by means of precomputed tables.
- Product
- Fortinet FortiPortal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Jul 21, 2021A CWE-759: Use of a One-Way Hash without a Salt vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVCVE-2021-22774 · Other software · Schneider-electric · reported by cybersecurity@se.comHigh 7.5
A CWE-759: Use of a One-Way Hash without a Salt vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 ) that could lead an attacker to get knowledge of charging station user account credentials using dictionary attacks techniques.
- Product
- Evlink City Evc1s22p4 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Jul 19, 2021KNX ETS5 through 5.7.6 uses the hard-coded password ETS5Password, with a salt value of Ivan Medvedev, allowing local users to read project information.CVE-2021-36799 · Other software · KNX · reported by MITREHigh 8.8
KNX ETS5 through 5.7.6 uses the hard-coded password ETS5Password, with a salt value of Ivan Medvedev, allowing local users to read project information. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
- Product
- Engineering Tool Software 5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
May 20, 2021Weak Encoding for Password in DoraCMS v2.1.1 and earlier allows attackers to obtain sensitive information as it does not use a random salt or IV for its AES-CBCCVE-2020-18220 · Other software · Html-js · reported by MITREHigh 7.5
Weak Encoding for Password in DoraCMS v2.1.1 and earlier allows attackers to obtain sensitive information as it does not use a random salt or IV for its AES-CBC encryption, causes password encrypted for users to be susceptible to dictionary attacks.
- Product
- Doracms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 23, 2021In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion.CVE-2021-31607 · Other software · Saltstack · reported by MITREHigh 7.8
In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes popen unsafely).
- Product
- Salt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orglists.fedoraproject.org
Mar 10, 2021In the crypt function, we attempt to null terminate a buffer using the size of the input salt without validating that the offset is within the buffer.CVE-2020-1921 · Other software · Facebook · reported by cve-assign@fb.comHigh 7.5
In the crypt function, we attempt to null terminate a buffer using the size of the input salt without validating that the offset is within the buffer. This issue affects HHVM versions prior to 4.56.3, all versions between 4.57.0 and 4.80.1, all versions between 4.81.0 and 4.93.1, and versions 4.94.0, 4.95.0, 4.96.0, 4.97.0, 4.98.0.
- Product
- HHVM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2021An issue was discovered in SaltStack Salt before 3002.5.CVE-2021-3197 · Other software · Saltstack · reported by MITRECritical 9.8
An issue was discovered in SaltStack Salt before 3002.5. The salt-api's ssh client is vulnerable to a shell injection by including ProxyCommand in an argument, or via ssh_options provided in an API request.
- Product
- Salt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Feb 27, 2021An issue was discovered in SaltStack Salt before 3002.5.CVE-2021-3148 · Other software · Saltstack · reported by MITRECritical 9.8
An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.py.
- Product
- Salt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Feb 27, 2021In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration.CVE-2021-3144 · Other software · Saltstack · reported by MITRECritical 9.1
In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)
- Product
- Salt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.