Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
puppet puppet agent vulnerabilities and exploits
(subscribe to this query)
7.5
CVSSv2
CVE-2016-2786
The pxp-agent component in Puppet Enterprise 2015.3.x prior to 2015.3.3 and Puppet Agent 1.3.x prior to 1.3.6 does not properly validate server certificates, which might allow remote malicious users to spoof brokers and execute arbitrary commands via a crafted certificate.
Puppet Puppet Agent 1.3.0
Puppet Puppet Agent 1.3.1
Puppet Puppet Agent 1.3.2
Puppet Puppet Agent 1.3.4
Puppet Puppet Agent 1.3.5
Puppet Puppet Enterprise 2015.3.0
Puppet Puppet Enterprise 2015.3.2
4
CVSSv2
CVE-2020-7942
Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate allowed access to everything in the infrastructure. When a node's catalog falls back to the `default` node, the catalo...
Puppet Puppet
Puppet Puppet Agent
4
CVSSv2
CVE-2021-27025
A flaw exists in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the first 'pluginsync'.
Puppet Puppet Agent
Puppet Puppet
Puppet Puppet Enterprise
Fedoraproject Fedora 35
5
CVSSv2
CVE-2021-27023
A flaw exists in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007
Puppet Puppet Server
Puppet Puppet Agent
Puppet Puppet Enterprise
Fedoraproject Fedora 35
6.5
CVSSv2
CVE-2016-5714
Puppet Enterprise 2015.3.3 and 2016.x prior to 2016.4.0, and Puppet Agent 1.3.6 up to and including 1.7.0 allow remote malicious users to bypass a host whitelist protection mechanism and execute arbitrary code on Puppet nodes via vectors related to command validation, aka "P...
Puppet Puppet Enterprise 2015.3.3
Puppet Puppet Enterprise 2016.1.1
Puppet Puppet Enterprise 2016.1.2
Puppet Puppet Enterprise 2016.2.0
Puppet Puppet Enterprise 2016.2.1
Puppet Puppet Agent
7.5
CVSSv2
CVE-2016-5713
Versions of Puppet Agent before 1.6.0 included a version of the Puppet Execution Protocol (PXP) agent that passed environment variables through to Puppet runs. This could allow unauthorized code to be loaded. This bug was first introduced in Puppet Agent 1.3.0.
Puppet Puppet Agent
9
CVSSv2
CVE-2017-2290
On Windows installations of the mcollective-puppet-agent plugin, version 1.12.0, a non-administrator user can create an executable that will be executed with administrator privileges on the next "mco puppet" run. Puppet Enterprise users are not affected. This is resolve...
Puppet Mcollective-puppet-agent 1.12.0
7.5
CVSSv2
CVE-2016-2785
Puppet Server prior to 2.3.2 and Ruby puppetmaster in Puppet 4.x prior to 4.4.2 and in Puppet Agent prior to 1.4.2 might allow remote malicious users to bypass intended auth.conf access restrictions by leveraging incorrect URL decoding.
Puppet Puppet 4.0.0
Puppet Puppet 4.1.0
Puppet Puppet 4.2.0
Puppet Puppet 4.2.1
Puppet Puppet 4.2.2
Puppet Puppet 4.2.3
Puppet Puppet 4.3.0
Puppet Puppet 4.3.1
Puppet Puppet 4.3.2
Puppet Puppet 4.4.0
Puppet Puppet 4.4.1
Puppet Puppet Server 2.0.0
Puppet Puppet Server 2.1.0
Puppet Puppet Server 2.1.1
Puppet Puppet Server 2.1.2
Puppet Puppet Server 2.2.0
Puppet Puppet Server 2.3.0
Puppet Puppet Server 2.3.1
Puppet Puppet Agent 1.4.1
2.6
CVSSv2
CVE-2011-3872
Puppet 2.6.x prior to 2.6.12 and 2.7.x prior to 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and 1.2 prior to 1.2.4, when signing an agent certificate, adds the Puppet master's certdnsnames values to the X.509 Subject Alternative Name field of the certificate, which all...
Puppet Puppet 2.6.1
Puppet Puppet 2.6.8
Puppetlabs Puppet 2.7.0
Puppet Puppet 2.7.4
Puppet Puppet 2.6.9
Puppet Puppet 2.6.10
Puppet Puppet 2.6.7
Puppet Puppet 2.6.6
Puppet Puppet 2.7.3
Puppet Puppet 2.7.5
Puppet Puppet 2.6.0
Puppet Puppet 2.6.4
Puppet Puppet 2.6.5
Puppet Puppet 2.6.11
Puppet Puppet 2.6.3
Puppet Puppet 2.6.2
Puppet Puppet 2.7.2
Puppetlabs Puppet 2.7.1
Puppet Puppet Enterprise 1.2.2
Puppet Puppet Enterprise 1.2.3
Puppetlabs Puppet Enterprise Users 1.0
Puppet Puppet Enterprise 1.2.0
1 Github repository
4.9
CVSSv2
CVE-2015-7331
The mcollective-puppet-agent plugin prior to 1.11.1 for Puppet allows remote malicious users to execute arbitrary code via vectors involving the --server argument.
Puppetlabs Mcollective-puppet-agent
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2022-48700
CVE-2022-48689
CVE-2024-27956
CVE-2023-6363
SQL
NULL pointer dereference
CVE-2023-41830
CVE-2015-2051
arbitrary
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
3
4
NEXT »