| CVE-2024-38824 |
Directory traversal vulnerability in recv_file method allows arbitrary files to be written to the master cache directory
|
9.6
Critical
|
Jun 13, 2025 |
| CVE-2025-22242 |
Worker process denial of service through file read operation
|
5.6
Medium
|
Jun 13, 2025 |
| CVE-2025-22241 |
File contents overwrite the VirtKey class is called when “on-demand pillar” data is requested and uses un-validated…
|
5.6
Medium
|
Jun 13, 2025 |
| CVE-2025-22240 |
Arbitrary directory creation or file deletion
|
6.3
Medium
|
Jun 13, 2025 |
| CVE-2025-22239 |
Arbitrary event injection on Salt Master
|
8.1
High
|
Jun 13, 2025 |
| CVE-2025-22238 |
Directory traversal attack in minion file cache creation
|
4.2
Medium
|
Jun 13, 2025 |
| CVE-2025-22237 |
An attacker with access to a minion key can exploit the 'on demand' pillar functionality with a specially crafted git…
|
6.7
Medium
|
Jun 13, 2025 |
| CVE-2025-22236 |
Minion event bus authorization bypass
|
8.1
High
|
Jun 13, 2025 |
| CVE-2024-38825 |
The salt.auth.pki module does not properly authenticate callers
|
6.4
Medium
|
Jun 13, 2025 |
| CVE-2024-38823 |
Salt's request server is vulnerable to replay attacks when not using a TLS encrypted transport
|
2.7
Low
|
Jun 13, 2025 |
| CVE-2024-38822 |
Multiple methods in the salt master skip minion token validation
|
2.7
Low
|
Jun 13, 2025 |