CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 0CVE-2014-0175
https://notcve.org/view.php?id=CVE-2014-0175
13 Dec 2019 — mcollective has a default password set at install mcollective presenta una contraseña predeterminada establecida en la instalación. • https://access.redhat.com/security/cve/cve-2014-0175 • CWE-798: Use of Hard-coded Credentials •
CVSS: 9.8EPSS: 0%CPEs: 12EXPL: 0CVE-2016-2788
https://notcve.org/view.php?id=CVE-2016-2788
13 Feb 2017 — MCollective 2.7.0 and 2.8.x before 2.8.9, as used in Puppet Enterprise, allows remote attackers to execute arbitrary code via vectors related to the mco ping command. MCollective 2.7.0 y 2.8.x en versiones anteriores a 2.8.9, como se utiliza en Puppet Enterprise, permite a atacantes remotos ejecutar código arbitrario a través de vectores relacionados con el comando mco ping. • https://puppet.com/security/cve/cve-2016-2788 • CWE-284: Improper Access Control •
CVSS: 7.4EPSS: 0%CPEs: 15EXPL: 1CVE-2014-3248 – Gentoo Linux Security Advisory 201412-15
https://notcve.org/view.php?id=CVE-2014-3248
16 Nov 2014 — Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) rubygems/defaults/operating_system.rb, (2) Win32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, or (6) safe_yaml/deep.so; or (7)... • http://puppetlabs.com/security/cve/cve-2014-3248 • CWE-17: DEPRECATED: Code •