Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
puppet vulnerabilities and exploits
(subscribe to this query)
9.8
CVSSv3
CVE-2021-27023
A flaw exists in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007
Puppet Puppet Server
Puppet Puppet Agent
Puppet Puppet Enterprise
Fedoraproject Fedora 35
6.5
CVSSv3
CVE-2020-7942
Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate allowed access to everything in the infrastructure. When a node's catalog falls back to the `default` node, the catalo...
Puppet Puppet
Puppet Puppet Agent
8.8
CVSSv3
CVE-2018-6513
Puppet Enterprise 2016.4.x before 2016.4.12, Puppet Enterprise 2017.3.x before 2017.3.7, Puppet Enterprise 2018.1.x before 2018.1.1, Puppet Agent 1.10.x before 1.10.13, Puppet Agent 5.3.x before 5.3.7, and Puppet Agent 5.5.x before 5.5.2, were vulnerable to an attack where an unp...
Puppet Puppet
Puppet Puppet Enterprise
4.9
CVSSv3
CVE-2021-27022
A flaw exists in bolt-server and ace where running a task with sensitive parameters results in those sensitive parameters being logged when they should not be. This issue only affects SSH/WinRM nodes (inventory service nodes).
Puppet Puppet
Puppet Puppet Enterprise
NA
CVE-2013-1640
The (1) template and (2) inline_template functions in the master server in Puppet prior to 2.6.18, 2.7.x prior to 2.7.21, and 3.1.x prior to 3.1.1, and Puppet Enterprise prior to 1.2.7 and 2.7.x prior to 2.7.2 allows remote authenticated users to execute arbitrary code via a craf...
Puppet Puppet
Puppet Puppet 3.1.0
Puppet Puppet Enterprise
Puppet Puppet Enterprise 2.7.0
Puppet Puppet Enterprise 2.7.1
Canonical Ubuntu Linux 12.04
Canonical Ubuntu Linux 11.10
Canonical Ubuntu Linux 12.10
5.3
CVSSv3
CVE-2016-9686
The Puppet Communications Protocol (PCP) Broker incorrectly validates message header sizes. An attacker could use this to crash the PCP Broker, preventing commands from being sent to agents. This is resolved in Puppet Enterprise 2016.4.3 and 2016.5.2.
Puppet Puppet Enterprise
Puppet Puppet Enterprise 2016.5.1
NA
CVE-2013-4965
Puppet Enterprise prior to 3.1.0 does not properly restrict the number of authentication attempts by a console account, which makes it easier for remote malicious users to bypass intended access restrictions via a brute-force attack.
Puppet Puppet Enterprise 3.0.0
Puppet Puppet Enterprise
6.8
CVSSv3
CVE-2015-4100
Puppet Enterprise 3.7.x and 3.8.0 might allow remote authenticated users to manage certificates for arbitrary nodes by leveraging a client certificate trusted by the master, aka a "Certificate Authority Reverse Proxy Vulnerability."
Puppet Puppet Enterprise 3.8.0
Puppet Puppet Enterprise
7.5
CVSSv3
CVE-2017-2299
Versions of the puppetlabs-apache module before 1.11.1 and 2.1.0 make it very easy to accidentally misconfigure TLS trust. If you specify the `ssl_ca` parameter but do not specify the `ssl_certs_dir` parameter, a default will be provided for the `ssl_certs_dir` that will trust ce...
Puppet Puppetlabs-apache 1.4.1
Puppet Puppetlabs-apache 1.4.0
Puppet Puppetlabs-apache 1.3.0
Puppet Puppetlabs-apache 1.2.0
Puppet Puppetlabs-apache 0.0.4
Puppet Puppetlabs-apache 1.7.0
Puppet Puppetlabs-apache 1.5.0
Puppet Puppetlabs-apache 1.1.1
Puppet Puppetlabs-apache 1.0.1
Puppet Puppetlabs-apache 0.7.0
Puppet Puppetlabs-apache 0.4.0
Puppet Puppetlabs-apache 2.0.0
Puppet Puppetlabs-apache 1.11.0
Puppet Puppetlabs-apache 1.10.0
Puppet Puppetlabs-apache 1.8.1
Puppet Puppetlabs-apache 1.8.0
Puppet Puppetlabs-apache 0.11.0
Puppet Puppetlabs-apache 0.10.0
Puppet Puppetlabs-apache 0.9.0
Puppet Puppetlabs-apache 0.8.1
Puppet Puppetlabs-apache 1.7.1
Puppet Puppetlabs-apache 1.6.0
6.5
CVSSv3
CVE-2017-10690
In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an environment that it was not classified to retrieve from. This was resolved in Puppet Agent 5.3.4, included in Puppet Enterprise 2017.3.4
Puppet Puppet
Puppet Puppet Enterprise
Redhat Satellite 6.4
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-29895
blind SQL injection
CVE-2024-5064
CVE-2023-52677
CVE-2023-52682
CVE-2024-30051
CVE-2024-35849
remote attackers
remote
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
2
3
4
5
6
7
8
9
10
NEXT »