Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

puppet puppet enterprise 2.0.1 vulnerabilities and exploits

(subscribe to this query)
NA
CVE-2013-4963
Multiple cross-site request forgery (CSRF) vulnerabilities in Puppet Enterprise (PE) prior to 3.0.1 allow remote malicious users to hijack the authentication of users for requests that deleting a (1) report, (2) group, or (3) class or possibly have other unspecified impact.
Puppet Puppet Enterprise 1.0Puppet Puppet Enterprise 2.5.1Puppet Puppet Enterprise 2.8.0Puppet Puppet Enterprise 2.8.1Puppet Puppet Enterprise 2.8.2Puppet Puppet Enterprise 2.8.3Puppet Puppet EnterprisePuppet Puppet Enterprise 1.2.0Puppet Puppet Enterprise 2.0.0Puppet Puppet Enterprise 2.0.1Puppet Puppet Enterprise 2.0.2Puppet Puppet Enterprise 1.1Puppet Puppet Enterprise 2.0.3Puppet Puppet Enterprise 2.5.2
NA
CVE-2012-1989
telnet.rb in Puppet 2.7.x prior to 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x prior to 2.5.1 allows local users to overwrite arbitrary files via a symlink attack on the NET::Telnet connection log (/tmp/out.log).
Puppet Puppet 2.7.8Puppet Puppet 2.7.6Puppet Puppet 2.7.11Puppet Puppet 2.7.9Puppetlabs Puppet 2.7.0Puppet Puppet 2.7.12Puppet Puppet 2.7.4Puppet Puppet 2.7.3Puppetlabs Puppet 2.7.1Puppet Puppet 2.7.10Puppet Puppet 2.7.5Puppet Puppet Enterprise 1.2.1Puppet Puppet Enterprise 1.2.4Puppet Puppet Enterprise 2.0.1Puppet Puppet Enterprise 2.5.0Puppet Puppet Enterprise 2.0.0Puppet Puppet Enterprise 2.0.2Puppet Puppet Enterprise 1.2.2Puppet Puppet Enterprise 1.2.0Puppet Puppet Enterprise 1.2.3
NA
CVE-2014-3248
Untrusted search path vulnerability in Puppet Enterprise 2.8 prior to 2.8.7, Puppet prior to 2.7.26 and 3.x prior to 3.6.2, Facter 1.6.x and 2.x prior to 2.0.2, Hiera prior to 1.3.4, and Mcollective prior to 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to ga...
Puppetlabs FacterPuppet Facter 2.0.1Puppet Facter 2.0.0Puppet Marionette CollectivePuppet HieraPuppet PuppetPuppet Puppet Enterprise
NA
CVE-2012-1053
The change_user method in the SUIDManager (lib/puppet/util/suidmanager.rb) in Puppet 2.6.x prior to 2.6.14 and 2.7.x prior to 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x prior to 2.0.3 does not properly manage group privileges, which allows local users to gain...
Puppet Puppet 2.6.13Puppet Puppet 2.6.5Puppet Puppet 2.6.4Puppet Puppet 2.6.10Puppet Puppet 2.6.9Puppet Puppet 2.6.8Puppet Puppet 2.6.1Puppet Puppet 2.6.0Puppet Puppet 2.6.7Puppet Puppet 2.6.6Puppet Puppet 2.6.12Puppet Puppet 2.6.11Puppet Puppet 2.6.3Puppet Puppet 2.6.2Puppet Puppet 2.7.9Puppet Puppet 2.7.8Puppet Puppet 2.7.4Puppet Puppet 2.7.3Puppet Puppet 2.7.5Puppet Puppet 2.7.2Puppet Puppet 2.7.10Puppetlabs Puppet 2.7.1
NA
CVE-2012-1054
Puppet 2.6.x prior to 2.6.14 and 2.7.x prior to 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x prior to 2.0.3, when managing a user login file with the k5login resource type, allows local users to gain privileges via a symlink attack on .k5login.
Puppet Puppet 2.6.11Puppet Puppet 2.6.10Puppet Puppet 2.6.3Puppet Puppet 2.6.2Puppet Puppet 2.6.7Puppet Puppet 2.6.6Puppet Puppet 2.6.13Puppet Puppet 2.6.12Puppet Puppet 2.6.5Puppet Puppet 2.6.4Puppet Puppet 2.6.9Puppet Puppet 2.6.8Puppet Puppet 2.6.1Puppet Puppet 2.6.0Puppet Puppet 2.7.10Puppet Puppet 2.7.9Puppetlabs Puppet 2.7.0Puppet Puppet 2.7.4Puppet Puppet 2.7.8Puppet Puppet 2.7.7Puppet Puppet 2.7.3Puppet Puppet 2.7.2
NA
CVE-2012-1906
Puppet 2.6.x prior to 2.6.15 and 2.7.x prior to 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x prior to 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or i...
Puppet Puppet 2.6.12Puppet Puppet 2.6.11Puppet Puppet 2.6.4Puppet Puppet 2.6.3Puppet Puppet 2.6.10Puppet Puppet 2.6.9Puppet Puppet 2.6.2Puppet Puppet 2.6.1Puppet Puppet 2.6.13Puppet Puppet 2.6.6Puppet Puppet 2.6.5Puppet Puppet 2.6.8Puppet Puppet 2.6.7Puppet Puppet 2.6.0Puppet Puppet 2.6.14Puppet Puppet 2.7.9Puppet Puppet 2.7.8Puppet Puppet 2.7.3Puppet Puppet 2.7.11Puppet Puppet 2.7.7Puppet Puppet 2.7.6Puppet Puppet 2.7.5
NA
CVE-2012-1986
Puppet 2.6.x prior to 2.6.15 and 2.7.x prior to 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x prior to 2.5.1 allows remote authenticated users with an authorized SSL key and certain permissions on the puppet master to read arbitrary files via a symlin...
Puppet Puppet 2.6.13Puppet Puppet 2.6.6Puppet Puppet 2.6.5Puppet Puppet 2.6.12Puppet Puppet 2.6.11Puppet Puppet 2.6.4Puppet Puppet 2.6.3Puppet Puppet 2.6.8Puppet Puppet 2.6.7Puppet Puppet 2.6.0Puppet Puppet 2.6.14Puppet Puppet 2.6.10Puppet Puppet 2.6.9Puppet Puppet 2.6.2Puppet Puppet 2.6.1Puppet Puppet 2.7.10Puppetlabs Puppet 2.7.0Puppet Puppet 2.7.4Puppet Puppet 2.7.9Puppet Puppet 2.7.8Puppet Puppet 2.7.3Puppet Puppet 2.7.11
NA
CVE-2012-1987
Unspecified vulnerability in Puppet 2.6.x prior to 2.6.15 and 2.7.x prior to 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x prior to 2.5.1 allows remote authenticated users with agent SSL keys to (1) cause a denial of service (memory consumption) via a...
Puppet Puppet 2.6.6Puppet Puppet 2.6.5Puppet Puppet 2.6.13Puppet Puppet 2.6.12Puppet Puppet 2.6.4Puppet Puppet 2.6.3Puppet Puppet 2.6.9Puppet Puppet 2.6.8Puppet Puppet 2.6.7Puppet Puppet 2.6.0Puppet Puppet 2.6.14Puppet Puppet 2.6.11Puppet Puppet 2.6.10Puppet Puppet 2.6.2Puppet Puppet 2.6.1Puppet Puppet 2.7.10Puppetlabs Puppet 2.7.1Puppetlabs Puppet 2.7.0Puppet Puppet 2.7.9Puppet Puppet 2.7.8Puppet Puppet 2.7.4Puppet Puppet 2.7.3
NA
CVE-2012-0891
Multiple cross-site scripting (XSS) vulnerabilities in Puppet Dashboard 1.0 prior to 1.2.5 and Enterprise 1.0 prior to 1.2.5 and 2.x prior to 2.0.1 allow remote malicious users to inject arbitrary web script or HTML via unspecified fields.
Puppet Puppet Enterprise 2.0.0Puppet Puppet Enterprise 1.0Puppet Puppet Enterprise 1.1Puppet Puppet Enterprise 1.2.0Puppet Puppet Dashboard 1.0.3Puppet Puppet Dashboard 1.2.3Puppet Puppet Dashboard 1.1.0Puppet Puppet Dashboard 1.1.1Puppet Puppet Dashboard 1.2.0Puppet Puppet Dashboard 1.2.1Puppet Puppet Dashboard 1.0.0Puppet Puppet Dashboard 1.0.4Puppet Puppet Dashboard 1.2.2Puppet Puppet Dashboard 1.2.4
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
blind SQL injectionCVE-2006-4304CVE-2023-26603CVE-2024-28327CVE-2023-50363CVE-2024-21905template injectionCVE-2024-3400cross-site request forgery
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook