Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
puppet puppet enterprise vulnerabilities and exploits
(subscribe to this query)
9.8
CVSSv3
CVE-2018-11749
When users are configured to use startTLS with RBAC LDAP, at login time, the user's credentials are sent via plaintext to the LDAP server. This affects Puppet Enterprise 2018.1.3, 2017.3.9, and 2016.4.14, and is fixed in Puppet Enterprise 2018.1.4, 2017.3.10, and 2016.4.15. ...
Puppet Puppet Enterprise
9.8
CVSSv3
CVE-2023-5309
Versions of Puppet Enterprise before 2021.7.6 and 2023.5 contain a flaw which results in broken session management for SAML implementations.
Puppet Puppet Enterprise
8.8
CVSSv3
CVE-2021-27020
Puppet Enterprise presented a security risk by not sanitizing user input when doing a CSV export.
Puppet Puppet Enterprise
NA
CVE-2012-3865
Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet prior to 2.6.17 and 2.7.x prior to 2.7.18, and Puppet Enterprise prior to 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server...
Puppetlabs Puppet
Puppet Puppet 2.7.8
Puppet Puppet 2.7.6
Puppet Puppet 2.7.11
Puppet Puppet 2.7.10
Puppet Puppet 2.7.9
Puppet Puppet 2.7.2
Puppetlabs Puppet 2.7.0
Puppet Puppet 2.7.13
Puppet Puppet 2.7.12
Puppet Puppet 2.7.3
Puppetlabs Puppet 2.7.1
Puppet Puppet 2.7.16
Puppet Puppet 2.7.14
Puppet Puppet 2.7.5
Puppet Puppet 2.7.4
Puppet Puppet 2.6.10
Puppet Puppet 2.6.11
Puppet Puppet 2.6.5
Puppet Puppet 2.6.13
Puppet Puppet 2.6.9
Puppet Puppet 2.6.8
NA
CVE-2012-3864
Puppet prior to 2.6.17 and 2.7.x prior to 2.7.18, and Puppet Enterprise prior to 2.5.2, allows remote authenticated users to read arbitrary files on the puppet master server by leveraging an arbitrary user's certificate and private key in a GET request.
Puppet Puppet 2.6.15
Puppetlabs Puppet
Puppet Puppet 2.6.11
Puppet Puppet 2.6.4
Puppet Puppet 2.6.5
Puppetlabs Puppet 2.7.0
Puppet Puppet 2.6.0
Puppet Puppet 2.6.14
Puppet Puppet 2.6.3
Puppet Puppet 2.6.2
Puppetlabs Puppet 2.7.1
Puppet Puppet 2.7.2
Puppet Puppet 2.7.10
Puppet Puppet 2.7.11
Puppet Puppet 2.7.8
Puppet Puppet 2.7.9
Puppet Puppet 2.7.17
Puppet Puppet 2.6.9
Puppet Puppet 2.6.10
Puppet Puppet 2.6.7
Puppet Puppet 2.6.6
Puppet Puppet 2.7.6
NA
CVE-2013-1654
Puppet 2.7.x prior to 2.7.21 and 3.1.x prior to 3.1.1, and Puppet Enterprise 2.7.x prior to 2.7.2, does not properly negotiate the SSL protocol between client and master, which allows remote malicious users to conduct SSLv2 downgrade attacks against SSLv3 sessions via unspecified...
Puppetlabs Puppet 2.7.19
Puppetlabs Puppet 2.7.20
Puppet Puppet 2.7.16
Puppet Puppet 2.7.14
Puppet Puppet 2.7.4
Puppet Puppet 2.7.3
Puppet Puppet 2.7.17
Puppet Puppet 2.7.13
Puppet Puppet 2.7.8
Puppet Puppet 2.7.9
Puppet Puppet 2.7.11
Puppet Puppet 2.7.18
Puppetlabs Puppet 2.7.0
Puppet Puppet 2.7.7
Puppet Puppet 2.7.5
Puppet Puppet 2.7.6
Puppet Puppet 2.7.2
Puppetlabs Puppet 2.7.1
Puppet Puppet 2.7.12
Puppet Puppet 2.7.10
Puppet Puppet Enterprise 3.1.0
Canonical Ubuntu Linux 11.10
8.8
CVSSv3
CVE-2015-7330
Puppet Enterprise 2015.3 prior to 2015.3.1 allows remote malicious users to bypass a host whitelist protection mechanism by leveraging the Puppet communications protocol.
Puppet Puppet Enterprise 2015.3.0
NA
CVE-2012-1988
Puppet 2.6.x prior to 2.6.15 and 2.7.x prior to 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x prior to 2.5.1 allows remote authenticated users with agent SSL keys and file-creation permissions on the puppet master to execute arbitrary commands by crea...
Puppet Puppet
Puppet Puppet Enterprise 1.0
Puppet Puppet Enterprise 1.1
Puppet Puppet Enterprise
Fedoraproject Fedora 17
Fedoraproject Fedora 16
Fedoraproject Fedora 15
Debian Debian Linux 7.0
Debian Debian Linux 6.0
Canonical Ubuntu Linux 11.04
Canonical Ubuntu Linux 11.10
Canonical Ubuntu Linux 10.04
NA
CVE-2014-3251
The MCollective aes_security plugin, as used in Puppet Enterprise prior to 3.3.0 and Mcollective prior to 2.5.3, does not properly validate new server certificates based on the CA certificate, which allows local users to establish unauthorized Mcollective connections via unspecif...
Puppet Puppet Enterprise
Puppetlabs Mcollective -
6.5
CVSSv3
CVE-2020-7942
Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate allowed access to everything in the infrastructure. When a node's catalog falls back to the `default` node, the catalo...
Puppet Puppet
Puppet Puppet Agent
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
cross-site scripting
CVE-2024-5158
XML external entity
CVE-2024-4262
CVE-2024-2036
CVE-2024-4985
CVE-2024-21791
remote attackers
CVE-2023-43208
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
3
4
5
6
7
8
9
NEXT »