CVSS: 9.8EPSS: 0%CPEs: 7EXPL: 0CVE-2016-2786 – Gentoo Linux Security Advisory 201606-02
https://notcve.org/view.php?id=CVE-2016-2786
06 Jun 2016 — The pxp-agent component in Puppet Enterprise 2015.3.x before 2015.3.3 and Puppet Agent 1.3.x before 1.3.6 does not properly validate server certificates, which might allow remote attackers to spoof brokers and execute arbitrary commands via a crafted certificate. El componente pxp-agent en Puppet Enterprise 2015.3.x en versiones anteriores a 2015.3.3 y Puppet Agent 1.3.x en versiones anteriores a 1.3.6 no valida adecuadamente certificados de servidor, lo que podría permitir a atacantes remotos espiar broker... • https://puppet.com/security/cve/CVE-2016-2786 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-7330
https://notcve.org/view.php?id=CVE-2015-7330
11 Apr 2016 — Puppet Enterprise 2015.3 before 2015.3.1 allows remote attackers to bypass a host whitelist protection mechanism by leveraging the Puppet communications protocol. Puppet Enterprise 2015.3 en versiones anteriores a 2015.3.1 permite a atacantes remotos eludir un mecanismo de protección de lista blanca de host aprovechándose del protocolo de comunicaciones Puppet. • http://www.securitytracker.com/id/1034550 • CWE-254: 7PK - Security Features •
CVSS: 4.7EPSS: 0%CPEs: 6EXPL: 0CVE-2015-7328
https://notcve.org/view.php?id=CVE-2015-7328
08 Jan 2016 — Puppet Server in Puppet Enterprise before 3.8.x before 3.8.3 and 2015.2.x before 2015.2.3 uses world-readable permissions for the private key of the Certification Authority (CA) certificate during the initial installation and configuration, which might allow local users to obtain sensitive information via unspecified vectors. Puppet Server en Puppet Enterprise en versiones anteriores a 3.8.x en versiones anteriores a 3.8.3 y 2015.2.x en versiones anteriores a 2015.2.3 utiliza permisos world-readable para la... • https://puppetlabs.com/security/cve/cve-2015-7328 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.9EPSS: 1%CPEs: 19EXPL: 1CVE-2015-1855 – Ubuntu Security Notice USN-3365-1
https://notcve.org/view.php?id=CVE-2015-1855
04 May 2015 — verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x before 2.1.6, and 2.2.x before 2.2.2 does not properly validate hostnames, which allows remote attackers to spoof servers via vectors related to (1) multiple wildcards, (1) wildcards in IDNA names, (3) case sensitivity, and (4) non-ASCII characters. La función Verified_certificate_identity en la extensión OpenSSL en Ruby versiones anteriores a 2.0.0 patchlevel 645, versiones 2.1.x anteriores a 2.1.6 y versiones 2... • https://github.com/vpereira/CVE-2015-1855 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 0%CPEs: 23EXPL: 0CVE-2015-1029
https://notcve.org/view.php?id=CVE-2015-1029
16 Jan 2015 — The puppetlabs-stdlib module 2.1 through 3.0 and 4.1.0 through 4.5.x before 4.5.1 for Puppet 2.8.8 and earlier allows remote authenticated users to gain privileges or obtain sensitive information by prepopulating the fact cache. El módulo puppetlabs-stdlib 2.1 hasta 3.0 y 4.1.0 hasta 4.5.x anterior a 4.5.1 para Puppet 2.8.8 y anteriores permite a usuarios remotos autenticados ganar privilegios o obtener información sensible mediante la prepoblación del caché de hechos. • http://puppetlabs.com/security/cve/cve-2015-1029 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2014-9355
https://notcve.org/view.php?id=CVE-2014-9355
19 Dec 2014 — Puppet Enterprise before 3.7.1 allows remote authenticated users to obtain licensing and certificate signing request information by leveraging access to an unspecified API endpoint. Puppet Enterprise anterior a 3.7.1 permite a usuarios remotos autenticados obtener información de las peticiones de firma de certificados y licencia aprovechando el acceso a un endpoint API sin especificar. • http://puppetlabs.com/security/cve/cve-2014-9355 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.4EPSS: 0%CPEs: 15EXPL: 1CVE-2014-3248 – Gentoo Linux Security Advisory 201412-15
https://notcve.org/view.php?id=CVE-2014-3248
16 Nov 2014 — Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) rubygems/defaults/operating_system.rb, (2) Win32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, or (6) safe_yaml/deep.so; or (7)... • http://puppetlabs.com/security/cve/cve-2014-3248 • CWE-17: DEPRECATED: Code •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2014-3251 – Gentoo Linux Security Advisory 201412-15
https://notcve.org/view.php?id=CVE-2014-3251
12 Aug 2014 — The MCollective aes_security plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective before 2.5.3, does not properly validate new server certificates based on the CA certificate, which allows local users to establish unauthorized Mcollective connections via unspecified vectors related to a race condition. El plugin MCollective aes_security, utilizado en Puppet Enterprise anterior a 3.3.0 y Mcollective anterior a 2.5.3, no valida debidamente los certificados de servidores nuevos basado en el certif... • http://puppetlabs.com/security/cve/cve-2014-3251 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 0CVE-2014-3249
https://notcve.org/view.php?id=CVE-2014-3249
17 Jun 2014 — Puppet Enterprise 2.8.x before 2.8.7 allows remote attackers to obtain sensitive information via vectors involving hiding and unhiding nodes. Puppet Enterprise 2.8.x anterior a 2.8.7 permite a atacantes remotos obtener información sensible a través de vectores involucrando nodos ocultos y visibles. • http://puppetlabs.com/security/cve/cve-2014-3249 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 14EXPL: 0CVE-2013-4963
https://notcve.org/view.php?id=CVE-2013-4963
14 Mar 2014 — Multiple cross-site request forgery (CSRF) vulnerabilities in Puppet Enterprise (PE) before 3.0.1 allow remote attackers to hijack the authentication of users for requests that deleting a (1) report, (2) group, or (3) class or possibly have other unspecified impact. Múltiples vulnerabilidades de CSRF en Puppet Enterprise (PE) anterior a 3.0.1 permiten a atacantes remotos secuestrar la autenticación de usuarios para solicitudes que mediante la eliminación de (1) un informe, (2) un grupo o (3) una clase o pos... • http://puppetlabs.com/security/cve/cve-2013-4963 • CWE-352: Cross-Site Request Forgery (CSRF) •