CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2016-9686
https://notcve.org/view.php?id=CVE-2016-9686
The Puppet Communications Protocol (PCP) Broker incorrectly validates message header sizes. An attacker could use this to crash the PCP Broker, preventing commands from being sent to agents. This is resolved in Puppet Enterprise 2016.4.3 and 2016.5.2. El Puppet Communications Protocol (PCP) Broker valida incorrectamente tamaños de la cabecera del mensaje. Un atacante podría utilizar ésto para bloquear el PCP Broker, evitando que se envíen comandos a los agentes. • https://puppet.com/security/cve/cve-2016-9686 • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2015-6501
https://notcve.org/view.php?id=CVE-2015-6501
Open redirect vulnerability in the Console in Puppet Enterprise before 2015.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the string parameter. La vulnerabilidad de redirección abierta en la Consola en Puppet Enterprise en versiones anteriores a 2015.2.1 permite a atacantes remotos redirigir a los usuarios a sitios web arbitrarios y llevar a cabo ataques de phishing a través de el parámetro string. • http://www.securityfocus.com/bid/93845 https://puppet.com/security/cve/CVE-2015-6501 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 2CVE-2016-5715 – Puppet Enterprise Web Interface Open Redirect
https://notcve.org/view.php?id=CVE-2016-5715
Open redirect vulnerability in the Console in Puppet Enterprise 2015.x and 2016.x before 2016.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // (slash slash) followed by a domain in the redirect parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6501. La vulnerabilidad de redirección abierta en la Consola en Puppet Enterprise 2015.x y 2016.x en versiones anteriores a 2016.4.0 permite a atacantes remotos redirigir a los usuarios a sitios web arbitrarios y llevar a cabo ataques de phishing mediante // (barra oblicua barra oblicua) seguida de un dominio en el parámetro de redirección. NOTA: esta vulnerabilidad existe debido a una corrección incompleta de CVE-2015-6501. Puppet Enterprise Web Interface versions prior to 2016.4.0 suffer from an open redirection vulnerability. • http://hyp3rlinx.altervista.org/advisories/PUPPET-AUTHENTICATION-REDIRECT.txt http://packetstormsecurity.com/files/139302/Puppet-Enterprise-Web-Interface-Open-Redirect.html http://www.securityfocus.com/archive/1/539618/100/0/threaded http://www.securityfocus.com/bid/93846 https://puppet.com/security/cve/cve-2016-5715 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 9.8EPSS: 0%CPEs: 7EXPL: 0CVE-2016-2786
https://notcve.org/view.php?id=CVE-2016-2786
The pxp-agent component in Puppet Enterprise 2015.3.x before 2015.3.3 and Puppet Agent 1.3.x before 1.3.6 does not properly validate server certificates, which might allow remote attackers to spoof brokers and execute arbitrary commands via a crafted certificate. El componente pxp-agent en Puppet Enterprise 2015.3.x en versiones anteriores a 2015.3.3 y Puppet Agent 1.3.x en versiones anteriores a 1.3.6 no valida adecuadamente certificados de servidor, lo que podría permitir a atacantes remotos espiar brokers y ejecutar comandos arbitrarios a través de un certificado manipulado. • https://puppet.com/security/cve/CVE-2016-2786 https://security.gentoo.org/glsa/201606-02 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-7330
https://notcve.org/view.php?id=CVE-2015-7330
Puppet Enterprise 2015.3 before 2015.3.1 allows remote attackers to bypass a host whitelist protection mechanism by leveraging the Puppet communications protocol. Puppet Enterprise 2015.3 en versiones anteriores a 2015.3.1 permite a atacantes remotos eludir un mecanismo de protección de lista blanca de host aprovechándose del protocolo de comunicaciones Puppet. • http://www.securitytracker.com/id/1034550 https://puppetlabs.com/security/cve/cve-2015-7330 • CWE-254: 7PK - Security Features •