Command and Code Injection

Every one of the 7 is a mark on the map. Named now: 1 to 7, most at risk first.

1. SaltStack <=3002 - Shell InjectionCVE-2020-16846SaltStack · CVSS 9.8 · 100% likely

   CWE-78

2. In SaltStack Salt through 2019.2.0, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network acces…CVE-2019-17361Saltstack · 15% likely

   CWE-77

3. An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks.CVE-2021-25283Saltstack · 10% likely

   CWE-94

4. An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of differe…CVE-2021-3148Saltstack · 8.2% likely

   CWE-77

5. In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires…CVE-2021-31607Saltstack · 5.9% likely

   CWE-78

6. An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows for a local privilege…CVE-2020-28243Saltstack · 4.3% likely

   CWE-77

7. Salt (aka SaltStack) before 0.17.1 allows remote attackers to execute arbitrary YAML code via unspecified vectors. NOTE: the vendor states that this might not be a vulnerability b…CVE-2013-4438Saltstack · 2.1% likely

   CWE-94

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.