CVSS: 2.1EPSS: 0%CPEs: 7EXPL: 0CVE-2013-4959
https://notcve.org/view.php?id=CVE-2013-4959
Puppet Enterprise before 3.0.1 uses HTTP responses that contain sensitive information without the "no-cache" setting, which might allow local users to obtain sensitive information such as (1) host name, (2) MAC address, and (3) SSH keys via the web browser cache. Puppet Enterprise anterior a 3.0.1 utiliza repuestas HTTP que contienen información sensible sin establecer la opción "no-cache", lo que podría permitir a usuarios locales obtener información sensible como (1) host name, (2) dirección MAC, y (3) claves SSH a través de la caché del navegador. • http://puppetlabs.com/security/cve/cve-2013-4959 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 0%CPEs: 7EXPL: 0CVE-2013-4964
https://notcve.org/view.php?id=CVE-2013-4964
Puppet Enterprise before 3.0.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. Puppet Enterprise anterior a 3.0.1, no establece el indicador de seguridad para la cookie de sesión en una del tipo HTTPS, lo que facilita a atacantes remotos la captura de las cookies interceptando la comunicación en una sesión https. • http://puppetlabs.com/security/cve/cve-2013-4964 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.8EPSS: 0%CPEs: 7EXPL: 0CVE-2013-4955
https://notcve.org/view.php?id=CVE-2013-4955
Open redirect vulnerability in the login page in Puppet Enterprise before 3.0.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the service parameter. Vulnerabilidad de redirección abierta en la página de login de Puppet Enterprise anterior a 3.0.1, permite a atacantes remotos redireccionar a usuarios a sitios web arbitrarios y llevar a cabo ataques de phishing a través de una URL en el parámetro "service". • http://puppetlabs.com/security/cve/cve-2013-4955 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 22%CPEs: 41EXPL: 0CVE-2013-3567 – puppet: remote code execution on master from unauthenticated clients
https://notcve.org/view.php?id=CVE-2013-3567
Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call. Puppet 2.7.x anterior a 2.7.22 y 3.2.x anterior a 3.2.2, y Puppet Enterprise anterior a 2.8.2, deserializa YAML sin confianza, lo que permite a atacantes remotos la instanciación de clases de Ruby y ejecutar código arbitrario a través de una llamada RESTAPI manipulada. • http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2013-08/msg00019.html http://rhn.redhat.com/errata/RHSA-2013-1283.html http://rhn.redhat.com/errata/RHSA-2013-1284.html http://secunia.com/advisories/54429 http://www.debian.org/security/2013/dsa-2715 http://www.ubuntu.com/usn/USN-1886-1 https://puppetlabs.com/security/cve/cve-2013-3567 https://access.redhat.com/security/cve/CVE-2013-3567 https& • CWE-20: Improper Input Validation CWE-502: Deserialization of Untrusted Data •
CVSS: 5.0EPSS: 0%CPEs: 9EXPL: 0CVE-2013-2716
https://notcve.org/view.php?id=CVE-2013-2716
Puppet Labs Puppet Enterprise before 2.8.0 does not use a "randomized secret" in the CAS client config file (cas_client_config.yml) when upgrading from older 1.2.x or 2.0.x versions, which allows remote attackers to obtain console access via a crafted cookie. Puppet Labs Puppet Enterprise antes de v2.8.0 no utiliza un "secreto aleatorio" en el archivo de configuración de cliente de CAS (cas_client_config.yml) que al actualizarse desde versiones v1.2.x v2.0.x o, permite a atacantes remotos obtener acceso a la consola a través de un cookie hecha a mano. • http://secunia.com/advisories/52862 https://exchange.xforce.ibmcloud.com/vulnerabilities/83171 https://puppetlabs.com/security/cve/cve-2013-2716 • CWE-310: Cryptographic Issues •