Page 3 of 49 results (0.013 seconds)

CVSS: 7.5EPSS: 94%CPEs: 6EXPL: 14

CVE-2017-7529 – nginx: Integer overflow in nginx range filter module leading to memory disclosure

https://notcve.org/view.php?id=CVE-2017-7529

13 Jul 2017 — Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request. Las versiones desde la 0.5.6 hasta 1.13.2 incluyéndola de Nginx, son susceptibles a una vulnerabilidad de desbordamiento de enteros en el módulo filtro de rango de nginx, resultando en un filtrado de información potencialmente confidencial activada por una petición especialmente cre... • https://github.com/liusec/CVE-2017-7529 • CWE-190: Integer Overflow or Wraparound •

CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0

CVE-2017-2294

https://notcve.org/view.php?id=CVE-2017-2294

05 Jul 2017 — Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 failed to mark MCollective server private keys as sensitive (a feature added in Puppet 4.6), so key values could be logged and stored in PuppetDB. These releases use the sensitive data type to ensure this won't happen anymore. Las versiones de Puppet Enterprise anteriores a 2016.4.5 o 2017.2.1, no pudieron marcar las claves privadas del servidor MCollective como confidenciales (una funcionalidad agregada en Puppet versión 4.6), ya que los valores d... • https://puppet.com/security/cve/cve-2017-2294 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 9.8EPSS: 0%CPEs: 12EXPL: 0

CVE-2016-2788

https://notcve.org/view.php?id=CVE-2016-2788

13 Feb 2017 — MCollective 2.7.0 and 2.8.x before 2.8.9, as used in Puppet Enterprise, allows remote attackers to execute arbitrary code via vectors related to the mco ping command. MCollective 2.7.0 y 2.8.x en versiones anteriores a 2.8.9, como se utiliza en Puppet Enterprise, permite a atacantes remotos ejecutar código arbitrario a través de vectores relacionados con el comando mco ping. • https://puppet.com/security/cve/cve-2016-2788 • CWE-284: Improper Access Control •

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0

CVE-2015-6501

https://notcve.org/view.php?id=CVE-2015-6501

12 Jan 2017 — Open redirect vulnerability in the Console in Puppet Enterprise before 2015.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the string parameter. La vulnerabilidad de redirección abierta en la Consola en Puppet Enterprise en versiones anteriores a 2015.2.1 permite a atacantes remotos redirigir a los usuarios a sitios web arbitrarios y llevar a cabo ataques de phishing a través de el parámetro string. • http://www.securityfocus.com/bid/93845 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •

CVSS: 4.7EPSS: 0%CPEs: 6EXPL: 0

CVE-2015-7328

https://notcve.org/view.php?id=CVE-2015-7328

08 Jan 2016 — Puppet Server in Puppet Enterprise before 3.8.x before 3.8.3 and 2015.2.x before 2015.2.3 uses world-readable permissions for the private key of the Certification Authority (CA) certificate during the initial installation and configuration, which might allow local users to obtain sensitive information via unspecified vectors. Puppet Server en Puppet Enterprise en versiones anteriores a 3.8.x en versiones anteriores a 3.8.3 y 2015.2.x en versiones anteriores a 2015.2.3 utiliza permisos world-readable para la... • https://puppetlabs.com/security/cve/cve-2015-7328 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 5.9EPSS: 4%CPEs: 19EXPL: 1

CVE-2015-1855 – Ubuntu Security Notice USN-3365-1

https://notcve.org/view.php?id=CVE-2015-1855

04 May 2015 — verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to (1) multiple wildcards, (1) wildcards in IDNA names, (3) case sensitivity, and (4) non-ASCII characters. La función Verified_certificate_identity en la extensión OpenSSL en Ruby versiones anteriores a 2.0.0 patchlevel 645, versiones 2.1.x anteriores a 2.1.6 y versiones 2... • https://github.com/vpereira/CVE-2015-1855 • CWE-20: Improper Input Validation •

CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0

CVE-2014-9355

https://notcve.org/view.php?id=CVE-2014-9355

19 Dec 2014 — Puppet Enterprise before 3.7.1 allows remote authenticated users to obtain licensing and certificate signing request information by leveraging access to an unspecified API endpoint. Puppet Enterprise anterior a 3.7.1 permite a usuarios remotos autenticados obtener información de las peticiones de firma de certificados y licencia aprovechando el acceso a un endpoint API sin especificar. • http://puppetlabs.com/security/cve/cve-2014-9355 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0

CVE-2014-3251 – Gentoo Linux Security Advisory 201412-15

https://notcve.org/view.php?id=CVE-2014-3251

12 Aug 2014 — The MCollective aes_security plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective before 2.5.3, does not properly validate new server certificates based on the CA certificate, which allows local users to establish unauthorized Mcollective connections via unspecified vectors related to a race condition. El plugin MCollective aes_security, utilizado en Puppet Enterprise anterior a 3.3.0 y Mcollective anterior a 2.5.3, no valida debidamente los certificados de servidores nuevos basado en el certif... • http://puppetlabs.com/security/cve/cve-2014-3251 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •

CVSS: 8.8EPSS: 0%CPEs: 14EXPL: 0

CVE-2013-4963

https://notcve.org/view.php?id=CVE-2013-4963

14 Mar 2014 — Multiple cross-site request forgery (CSRF) vulnerabilities in Puppet Enterprise (PE) before 3.0.1 allow remote attackers to hijack the authentication of users for requests that deleting a (1) report, (2) group, or (3) class or possibly have other unspecified impact. Múltiples vulnerabilidades de CSRF en Puppet Enterprise (PE) anterior a 3.0.1 permiten a atacantes remotos secuestrar la autenticación de usuarios para solicitudes que mediante la eliminación de (1) un informe, (2) un grupo o (3) una clase o pos... • http://puppetlabs.com/security/cve/cve-2013-4963 • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0

CVE-2013-4966

https://notcve.org/view.php?id=CVE-2013-4966

07 Mar 2014 — The master external node classification script in Puppet Enterprise before 3.2.0 does not verify the identity of consoles, which allows remote attackers to create arbitrary classifications on the master by spoofing a console. El script maestro de clasificación de nodo externo en Puppet Enterprise anterior a 3.2.0 no verifica la identidad de consolas, lo que permite a atacantes remotos crear clasificaciones arbitrarias en el maestro mediante la falsificación de una consola. • http://puppetlabs.com/security/cve/cve-2013-4966 • CWE-287: Improper Authentication •