CVSS: 7.2EPSS: 0%CPEs: 6EXPL: 0CVE-2016-5714
https://notcve.org/view.php?id=CVE-2016-5714
Puppet Enterprise 2015.3.3 and 2016.x before 2016.4.0, and Puppet Agent 1.3.6 through 1.7.0 allow remote attackers to bypass a host whitelist protection mechanism and execute arbitrary code on Puppet nodes via vectors related to command validation, aka "Puppet Execution Protocol (PXP) Command Whitelist Validation Vulnerability." Puppet Enterprise 2015.3.3 y 2016.x en versiones anteriores a la 2016.4.0 y Puppet Agent 1.3.6 hasta la versión 1.7.0 permite que atacantes remotos omitan un mecanismo de protección de listas blancas de host y ejecutar código arbitrario en nodos Puppet mediante vectores relacionados con la validación de comandos. Esto también se conoce como "Puppet Execution Protocol (PXP) Command Whitelist Validation Vulnerability". • https://bugs.gentoo.org/597684 https://puppet.com/security/cve/cve-2016-5714 https://puppet.com/security/cve/pxp-agent-oct-2016 https://security.gentoo.org/glsa/201710-12 • CWE-284: Improper Access Control •
CVSS: 8.8EPSS: 0%CPEs: 12EXPL: 0CVE-2016-5716
https://notcve.org/view.php?id=CVE-2016-5716
The console in Puppet Enterprise 2015.x and 2016.x prior to 2016.4.0 includes unsafe string reads that potentially allows for remote code execution on the console node. La consola en Puppet Enterprise en versiones 2015.x y 2016.x anteriores a la versión 2016.4.0 incluye lecturas de strings no seguros que podrían permitir que se ejecutase código de forma remota en el nodo de la consola. • https://puppet.com/security/cve/pe-console-oct-2016 • CWE-134: Use of Externally-Controlled Format String •
CVSS: 7.5EPSS: 96%CPEs: 6EXPL: 8CVE-2017-7529 – nginx: Integer overflow in nginx range filter module leading to memory disclosure
https://notcve.org/view.php?id=CVE-2017-7529
Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow vulnerability in nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request. Las versiones desde la 0.5.6 hasta 1.13.2 incluyéndola de Nginx, son susceptibles a una vulnerabilidad de desbordamiento de enteros en el módulo filtro de rango de nginx, resultando en un filtrado de información potencialmente confidencial activada por una petición especialmente creada. A flaw within the processing of ranged HTTP requests has been discovered in the range filter module of nginx. A remote attacker could possibly exploit this flaw to disclose parts of the cache file header, or, if used in combination with third party modules, disclose potentially sensitive memory by sending specially crafted HTTP requests. • https://github.com/liusec/CVE-2017-7529 https://github.com/MaxSecurity/CVE-2017-7529-POC https://github.com/Shehzadcyber/CVE-2017-7529 https://github.com/SirEagIe/CVE-2017-7529 https://github.com/cyberk1w1/CVE-2017-7529 https://github.com/cyberharsh/nginx-CVE-2017-7529 https://github.com/coolman6942o/-Exploit-CVE-2017-7529 https://github.com/fu2x2000/CVE-2017-7529-Nginx---Remote-Integer-Overflow-Exploit http://mailman.nginx.org/pipermail/nginx-announce/2017/000200.html http: • CWE-190: Integer Overflow or Wraparound •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2017-2294
https://notcve.org/view.php?id=CVE-2017-2294
Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 failed to mark MCollective server private keys as sensitive (a feature added in Puppet 4.6), so key values could be logged and stored in PuppetDB. These releases use the sensitive data type to ensure this won't happen anymore. Las versiones de Puppet Enterprise anteriores a 2016.4.5 o 2017.2.1, no pudieron marcar las claves privadas del servidor MCollective como confidenciales (una funcionalidad agregada en Puppet versión 4.6), ya que los valores de clave podrían ser registrados y almacenados en PuppetDB. Estas versiones utilizan el tipo de datos confidenciales para garantizar que esto no suceda. • https://puppet.com/security/cve/cve-2017-2294 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 2CVE-2016-5715 – Puppet Enterprise Web Interface Open Redirect
https://notcve.org/view.php?id=CVE-2016-5715
Open redirect vulnerability in the Console in Puppet Enterprise 2015.x and 2016.x before 2016.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // (slash slash) followed by a domain in the redirect parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6501. La vulnerabilidad de redirección abierta en la Consola en Puppet Enterprise 2015.x y 2016.x en versiones anteriores a 2016.4.0 permite a atacantes remotos redirigir a los usuarios a sitios web arbitrarios y llevar a cabo ataques de phishing mediante // (barra oblicua barra oblicua) seguida de un dominio en el parámetro de redirección. NOTA: esta vulnerabilidad existe debido a una corrección incompleta de CVE-2015-6501. Puppet Enterprise Web Interface versions prior to 2016.4.0 suffer from an open redirection vulnerability. • http://hyp3rlinx.altervista.org/advisories/PUPPET-AUTHENTICATION-REDIRECT.txt http://packetstormsecurity.com/files/139302/Puppet-Enterprise-Web-Interface-Open-Redirect.html http://www.securityfocus.com/archive/1/539618/100/0/threaded http://www.securityfocus.com/bid/93846 https://puppet.com/security/cve/cve-2016-5715 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •