# Saltstack Salt


- [CVE-2020-16846](https://insights.sbomify.com/CVE-2020-16846/): SaltStack Salt Shell Injection (critical 9.8, exploited in the wild)
- [CVE-2020-11651](https://insights.sbomify.com/CVE-2020-11651/): SaltStack Salt Authentication Bypass (critical 9.8, exploited in the wild)
- [CVE-2020-11652](https://insights.sbomify.com/CVE-2020-11652/): SaltStack Salt Path Traversal (medium 6.5, exploited in the wild)
- [CVE-2013-4437](https://insights.sbomify.com/CVE-2013-4437/): SaltStack insecurely uses /tmp (critical 10.0)
- [CVE-2013-6617](https://insights.sbomify.com/CVE-2013-6617/): SaltStack Privilege Escalation vulnerability (critical 10.0)
- [CVE-2021-33226](https://insights.sbomify.com/CVE-2021-33226/): Code injection in n/a (critical 9.8)
- [CVE-2021-25315](https://insights.sbomify.com/CVE-2021-25315/): salt-api unauthenticated remote code execution (critical 9.8)
- [CVE-2021-25281](https://insights.sbomify.com/CVE-2021-25281/): SaltStack Salt Improper Authentication vulnerability (critical 9.8)
- [CVE-2021-25283](https://insights.sbomify.com/CVE-2021-25283/): SaltStack Salt Server Side Template Injection (critical 9.8)
- [CVE-2021-3148](https://insights.sbomify.com/CVE-2021-3148/): SaltStack Salt command injection in the Salt-API when using the Salt-SSH client (critical 9.8)
- [CVE-2021-3197](https://insights.sbomify.com/CVE-2021-3197/): SaltStack Salt is vulnerable to shell injection via ProxyCommand argument (critical 9.8)
- [CVE-2020-25592](https://insights.sbomify.com/CVE-2020-25592/): SaltStack Salt Improper Validation of eauth credentials and tokens in salt-netapi (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/products/saltstack/salt/