Access Control

Every one of the 7 is a mark on the map. Named now: 1 to 7, most at risk first.

1. The salt master in Salt (aka SaltStack) 0.11.0 through 0.17.0 does not properly drop group privileges, which makes it easier for remote attackers to gain privileges.CVE-2013-6617Saltstack · 3.0% likely

   CWE-264

2. Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching.CVE-2016-9639Saltstack · 2.7% likely

   CWE-284

3. An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2. PAM auth fails to reject locked accounts, which allows a previously authorized user whose acco…CVE-2022-22967Saltstack · CVSS 8.8 · 2.1% likely

   CWE-863

4. Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle attackers to execute arbitrary code by inserting packets into t…CVE-2016-1866Saltstack · 1.5% likely

   CWE-284

5. Salt (aka SaltStack) before 0.15.0 through 0.17.0 allows remote authenticated minions to impersonate arbitrary minions via a crafted minion with a valid key.CVE-2013-4439Saltstack · 1.5% likely

   CWE-264

6. An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. When configured as a Master-of-Masters, with a publisher_acl, if a user configured in the publ…CVE-2022-22941Saltstack · CVSS 8.8 · 1.3% likely

   CWE-732

7. The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions.CVE-2020-17490Saltstack · 0.4% likely

   CWE-732

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.