CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2013-1398
https://notcve.org/view.php?id=CVE-2013-1398
14 Mar 2014 — The pe_mcollective module in Puppet Enterprise (PE) before 2.7.1 does not properly restrict access to a catalog of private SSL keys, which allows remote authenticated users to obtain sensitive information and gain privileges by leveraging root access to a node, related to the master role. El módulo pe_mcollective en Puppet Enterprise (PE) anterior a 2.7.1 no restringe debidamente acceso al catálogo de claves privadas de SSL, lo que permite a usuarios remotos autenticados obtener información sensible y ganar... • http://puppetlabs.com/security/cve/cve-2013-1398 • CWE-310: Cryptographic Issues •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2013-1399
https://notcve.org/view.php?id=CVE-2013-1399
14 Mar 2014 — Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) node request management, (2) live management, and (3) user administration components in the console in Puppet Enterprise (PE) before 2.7.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors. Múltiples vulnerabilidades de CSRF en los componentes (1) gestión de solicitudes de nodo, (2) gestión viva y (3) administración de usuario en la consola en Puppet Enterprise (PE) anterior a 2.7.1 permiten a ... • https://puppetlabs.com/security/cve/cve-2013-1399 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.1EPSS: 0%CPEs: 5EXPL: 0CVE-2012-5158
https://notcve.org/view.php?id=CVE-2012-5158
14 Mar 2014 — Puppet Enterprise (PE) before 2.6.1 does not properly invalidate sessions when the session secret has changed, which allows remote authenticated users to retain access via unspecified vectors. Puppet Enterprise (PE) anterior a 2.6.1 no inválida debidamente sesiones cuando el secreto de la sesión ha cambiado, lo que permite a usuarios remotos autenticados retener acceso a través de vectores no especificados. • http://puppetlabs.com/security/cve/cve-2012-5158 • CWE-287: Improper Authentication •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2011-0528
https://notcve.org/view.php?id=CVE-2011-0528
17 Feb 2014 — Puppet 2.6.0 through 2.6.3 does not properly restrict access to node resources, which allows remote authenticated Puppet nodes to read or modify the resources of other nodes via unspecified vectors. Puppet 2.6.0 hasta 2.6.3 no restringe debidamente el acceso a los recursos de nodo, lo que permite a nodos Puppet remotos autenticados leer o modificar los recursos de otros nodos a través de vectores no especificados. • http://www.mail-archive.com/puppet-users%40googlegroups.com/msg16429.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.0EPSS: 0%CPEs: 11EXPL: 0CVE-2013-4969 – Mandriva Linux Security Advisory 2014-040
https://notcve.org/view.php?id=CVE-2013-4969
03 Jan 2014 — Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified files. Puppet anteriores a 3.3.3. y 3.4 anteriores a 3.4.1 y Puppet Enterprise (PE) anteriores a 2.8.4 y 3.1 anteriores a 3.1.1 permite a usuarios locales sobreescribir ficheros arbitrarios a través de un ataque de enlaces simbólicos en ficheros no especificados. Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise... • http://puppetlabs.com/security/cve/cve-2013-4969 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 5.1EPSS: 0%CPEs: 28EXPL: 0CVE-2013-4956 – Puppet: Local Privilege Escalation/Arbitrary Code Execution
https://notcve.org/view.php?id=CVE-2013-4956
15 Aug 2013 — Puppet Module Tool (PMT), as used in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, installs modules with weak permissions if those permissions were used when the modules were originally built, which might allow local users to read or modify those modules depending on the original permissions. Puppet Module Tool (PMT), usado en Puppet 2.7.x anterior a 2.7.23 y 3.2.x anterior a 3.2.4, y Puppet Enterprise 2.8.x anterior a 2.8.3 y 3.0.x anter... • http://puppetlabs.com/security/cve/cve-2013-4956 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 0%CPEs: 11EXPL: 0CVE-2013-4761 – Puppet: resource_type service code execution
https://notcve.org/view.php?id=CVE-2013-4761
15 Aug 2013 — Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service. NOTE: this vulnerability can only be exploited utilizing unspecified "local file system access" to the Puppet Master. Vulnerabilidad sin especificar en Puppet 2.7.x anterior a 2.7.23 y 3.2.x anterior a 3.2.4, y Puppet Enterprise 2.8.x anterior a 2.8.3 y 3.0.x a... • http://lists.opensuse.org/opensuse-security-announce/2014-01/msg00009.html •
CVSS: 7.5EPSS: 6%CPEs: 41EXPL: 0CVE-2013-3567 – puppet: remote code execution on master from unauthenticated clients
https://notcve.org/view.php?id=CVE-2013-3567
19 Jun 2013 — Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call. Puppet 2.7.x anterior a 2.7.22 y 3.2.x anterior a 3.2.2, y Puppet Enterprise anterior a 2.8.2, deserializa YAML sin confianza, lo que permite a atacantes remotos la instanciación de clases de Ruby y ejecutar código arbitrario a través de una llamada RESTAPI manipulada. Pu... • http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00002.html • CWE-20: Improper Input Validation CWE-502: Deserialization of Untrusted Data •
CVSS: 7.5EPSS: 0%CPEs: 9EXPL: 0CVE-2013-2716
https://notcve.org/view.php?id=CVE-2013-2716
10 Apr 2013 — Puppet Labs Puppet Enterprise before 2.8.0 does not use a "randomized secret" in the CAS client config file (cas_client_config.yml) when upgrading from older 1.2.x or 2.0.x versions, which allows remote attackers to obtain console access via a crafted cookie. Puppet Labs Puppet Enterprise antes de v2.8.0 no utiliza un "secreto aleatorio" en el archivo de configuración de cliente de CAS (cas_client_config.yml) que al actualizarse desde versiones v1.2.x v2.0.x o, permite a atacantes remotos obtener acceso a l... • http://secunia.com/advisories/52862 • CWE-310: Cryptographic Issues •
CVSS: 6.5EPSS: 1%CPEs: 19EXPL: 0CVE-2013-2274 – Puppet: HTTP PUT report saving code execution vulnerability
https://notcve.org/view.php?id=CVE-2013-2274
20 Mar 2013 — Puppet 2.6.x before 2.6.18 and Puppet Enterprise 1.2.x before 1.2.7 allows remote authenticated users to execute arbitrary code on the puppet master, or an agent with puppet kick enabled, via a crafted request for a report. Puppet v2.6.x anterior a v2.6.18 y Puppet Enterprise v1.2.x anterior a v1.2.7 permite a usuarios remotos autenticados ejecutar código arbitrario en el puppet master, o un agente con puppet kick habilitado, mediante una petición espcialmente diesñada para un report. Multiple vulnerabiliti... • http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00004.html •