Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
puppet puppet enterprise vulnerabilities and exploits
(subscribe to this query)
5.3
CVSSv3
CVE-2016-2787
The Puppet Communications Protocol in Puppet Enterprise 2015.3.x prior to 2015.3.3 does not properly validate certificates for the broker node, which allows remote non-whitelisted hosts to prevent runs from triggering via unspecified vectors.
Puppetlabs Puppet Enterprise 2015.3
Puppet Puppet Enterprise 2015.3.2
6.5
CVSSv3
CVE-2017-10690
In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an environment that it was not classified to retrieve from. This was resolved in Puppet Agent 5.3.4, included in Puppet Enterprise 2017.3.4
Puppet Puppet
Puppet Puppet Enterprise
Redhat Satellite 6.4
NA
CVE-2012-3408
lib/puppet/network/authstore.rb in Puppet prior to 2.7.18, and Puppet Enterprise prior to 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote malicious users to spoof an agent by acquiring a previously used IP address.
Puppetlabs Puppet
Puppet Puppet Enterprise
4.3
CVSSv3
CVE-2021-27019
PuppetDB logging included potentially sensitive system information.
Puppet Puppet Enterprise
Puppet Puppetdb
NA
CVE-2014-3248
Untrusted search path vulnerability in Puppet Enterprise 2.8 prior to 2.8.7, Puppet prior to 2.7.26 and 3.x prior to 3.6.2, Facter 1.6.x and 2.x prior to 2.0.2, Hiera prior to 1.3.4, and Mcollective prior to 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to ga...
Puppetlabs Facter
Puppet Facter 2.0.1
Puppet Facter 2.0.0
Puppet Marionette Collective
Puppet Hiera
Puppet Puppet
Puppet Puppet Enterprise
NA
CVE-2012-3867
lib/puppet/ssl/certificate_authority.rb in Puppet prior to 2.6.17 and 2.7.x prior to 2.7.18, and Puppet Enterprise prior to 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted re...
Puppet Puppet 2.6.0
Puppet Puppet 2.6.14
Puppet Puppet 2.6.12
Puppet Puppet 2.6.13
Puppet Puppet 2.7.2
Puppet Puppet 2.7.3
Puppet Puppet 2.7.4
Puppet Puppet 2.7.5
Puppet Puppet 2.6.15
Puppet Puppet 2.6.10
Puppet Puppet 2.6.4
Puppet Puppet 2.6.7
Puppet Puppet 2.6.5
Puppetlabs Puppet 2.7.1
Puppet Puppet 2.7.6
Puppet Puppet 2.7.8
Puppet Puppet 2.7.16
Puppet Puppet 2.6.3
Puppet Puppet 2.6.2
Puppet Puppet 2.6.1
Puppet Puppet 2.6.8
Puppet Puppet 2.7.10
NA
CVE-2012-3866
lib/puppet/defaults.rb in Puppet 2.7.x prior to 2.7.18, and Puppet Enterprise prior to 2.5.2, uses 0644 permissions for last_run_report.yaml, which allows local users to obtain sensitive configuration information by leveraging access to the puppet master server to read this file.
Puppet Puppet 2.7.12
Puppet Puppet 2.7.11
Puppet Puppet 2.7.3
Puppetlabs Puppet 2.7.1
Puppet Puppet 2.7.14
Puppet Puppet 2.7.13
Puppet Puppet 2.7.5
Puppet Puppet 2.7.4
Puppetlabs Puppet
Puppet Puppet 2.7.16
Puppet Puppet 2.7.8
Puppet Puppet 2.7.6
Puppet Puppet 2.7.10
Puppet Puppet 2.7.9
Puppet Puppet 2.7.2
Puppetlabs Puppet 2.7.0
Puppet Puppet Enterprise
NA
CVE-2013-2274
Puppet 2.6.x prior to 2.6.18 and Puppet Enterprise 1.2.x prior to 1.2.7 allows remote authenticated users to execute arbitrary code on the puppet master, or an agent with puppet kick enabled, via a crafted request for a report.
Puppet Puppet 2.6.14
Puppet Puppet 2.6.12
Puppet Puppet 2.6.1
Puppet Puppet 2.6.8
Puppet Puppet 2.6.0
Puppet Puppet 2.6.15
Puppet Puppet 2.6.11
Puppet Puppet 2.6.10
Puppet Puppet 2.6.5
Puppetlabs Puppet 2.6.17
Puppet Puppet 2.6.16
Puppet Puppet 2.6.4
Puppet Puppet 2.6.3
Puppet Puppet 2.6.2
Puppet Puppet 2.6.13
Puppet Puppet 2.6.9
Puppet Puppet 2.6.7
Puppet Puppet 2.6.6
Puppet Puppet Enterprise 1.2.0
9.8
CVSSv3
CVE-2018-6512
The previous version of Puppet Enterprise 2018.1 is vulnerable to unsafe code execution when upgrading pe-razor-server. Affected releases are Puppet Enterprise: 2018.1.x versions before 2018.1.1 and razor-server and pe-razor-server before 1.9.0.0.
Puppet Razor-server
Puppet Puppet Enterprise
Puppet Pe-razor-server
9.8
CVSSv3
CVE-2023-5309
Versions of Puppet Enterprise before 2021.7.6 and 2023.5 contain a flaw which results in broken session management for SAML implementations.
Puppet Puppet Enterprise
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-25525
CVE-2024-4652
CVE-2024-1438
CVE-2024-4671
CVE-2024-34351
arbitrary
CVE-2024-4650
SQL injection
overflow
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
7
8
9
NEXT »