Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
puppet vulnerabilities and exploits
(subscribe to this query)
4.3
CVSSv2
CVE-2015-6502
Cross-site scripting (XSS) vulnerability in the console in Puppet Enterprise prior to 2015.2.1 allows remote malicious users to inject arbitrary web script or HTML via the string parameter, related to Login Redirect.
Puppet Puppet Enterprise
4.3
CVSSv2
CVE-2015-8470
The console in Puppet Enterprise 3.7.x, 3.8.x, and 2015.2.x does not set the secure flag for the JSESSIONID cookie in an HTTPS session, which makes it easier for remote malicious users to capture this cookie by intercepting its transmission within an HTTP session.
Puppet Puppet Enterprise
4
CVSSv2
CVE-2014-3250
The default vhost configuration file in Puppet prior to 3.6.2 does not include the SSLCARevocationCheck directive, which might allow remote malicious users to obtain sensitive information via a revoked certificate when a Puppet master runs with Apache 2.4.
Puppet Puppet
Redhat Linux -
7.5
CVSSv2
CVE-2016-5713
Versions of Puppet Agent before 1.6.0 included a version of the Puppet Execution Protocol (PXP) agent that passed environment variables through to Puppet runs. This could allow unauthorized code to be loaded. This bug was first introduced in Puppet Agent 1.3.0.
Puppet Puppet Agent
6.5
CVSSv2
CVE-2016-5714
Puppet Enterprise 2015.3.3 and 2016.x prior to 2016.4.0, and Puppet Agent 1.3.6 up to and including 1.7.0 allow remote malicious users to bypass a host whitelist protection mechanism and execute arbitrary code on Puppet nodes via vectors related to command validation, aka "P...
Puppet Puppet Enterprise 2015.3.3
Puppet Puppet Enterprise 2016.1.1
Puppet Puppet Enterprise 2016.1.2
Puppet Puppet Enterprise 2016.2.0
Puppet Puppet Enterprise 2016.2.1
Puppet Puppet Agent
5
CVSSv2
CVE-2017-2299
Versions of the puppetlabs-apache module before 1.11.1 and 2.1.0 make it very easy to accidentally misconfigure TLS trust. If you specify the `ssl_ca` parameter but do not specify the `ssl_certs_dir` parameter, a default will be provided for the `ssl_certs_dir` that will trust ce...
Puppet Puppetlabs-apache 1.4.1
Puppet Puppetlabs-apache 1.4.0
Puppet Puppetlabs-apache 1.3.0
Puppet Puppetlabs-apache 1.2.0
Puppet Puppetlabs-apache 0.0.4
Puppet Puppetlabs-apache 1.7.0
Puppet Puppetlabs-apache 1.5.0
Puppet Puppetlabs-apache 1.1.1
Puppet Puppetlabs-apache 1.0.1
Puppet Puppetlabs-apache 0.7.0
Puppet Puppetlabs-apache 0.4.0
Puppet Puppetlabs-apache 2.0.0
Puppet Puppetlabs-apache 1.11.0
Puppet Puppetlabs-apache 1.10.0
Puppet Puppetlabs-apache 1.8.1
Puppet Puppetlabs-apache 1.8.0
Puppet Puppetlabs-apache 0.11.0
Puppet Puppetlabs-apache 0.10.0
Puppet Puppetlabs-apache 0.9.0
Puppet Puppetlabs-apache 0.8.1
Puppet Puppetlabs-apache 1.7.1
Puppet Puppetlabs-apache 1.6.0
6.5
CVSSv2
CVE-2016-5716
The console in Puppet Enterprise 2015.x and 2016.x before 2016.4.0 includes unsafe string reads that potentially allows for remote code execution on the console node.
Puppet Puppet Enterprise 2015.3.2
Puppet Puppet Enterprise 2015.2.3
Puppet Puppet Enterprise 2015.2.0
Puppet Puppet Enterprise 2015.3.3
Puppet Puppet Enterprise 2016.2.1
Puppet Puppet Enterprise 2016.2.0
Puppet Puppet Enterprise 2016.1.1
Puppet Puppet Enterprise 2015.3.1
Puppet Puppet Enterprise 2015.2.1
Puppet Puppet Enterprise 2016.1.2
Puppet Puppet Enterprise 2015.3.0
Puppet Puppet Enterprise 2015.2.2
5
CVSSv2
CVE-2017-2294
Versions of Puppet Enterprise before 2016.4.5 or 2017.2.1 failed to mark MCollective server private keys as sensitive (a feature added in Puppet 4.6), so key values could be logged and stored in PuppetDB. These releases use the sensitive data type to ensure this won't happen...
Puppet Puppet Enterprise 2016.5.2
Puppet Puppet Enterprise 2017.1.0
Puppet Puppet Enterprise 2017.1.1
Puppet Puppet Enterprise 2016.5.1
Puppet Puppet Enterprise
7.5
CVSSv2
CVE-2017-2292
Versions of MCollective before 2.10.4 deserialized YAML from agents without calling safe_load, allowing the potential for arbitrary code execution on the server. The fix for this is to call YAML.safe_load on input. This has been tested in all Puppet-supplied MCollective plugins, ...
Puppet Mcollective
4.3
CVSSv2
CVE-2017-2298
The mcollective-sshkey-security plugin prior to 0.5.1 for Puppet uses a server-specified identifier as part of a path where a file is written. A compromised server could use this to write a file to an arbitrary location on the client with the filename appended with the string &qu...
Puppet Mcollective-sshkey-security
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2023-30310
CVE-2024-21683
CVE-2024-22187
chrome
deserialization
XPath injection
CVE-2024-27842
denial of service
CVE-2024-24851
google
CVE-2024-35400
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
2
3
4
5
6
7
8
9
10
NEXT »