CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 0CVE-2014-0175
https://notcve.org/view.php?id=CVE-2014-0175
mcollective has a default password set at install mcollective presenta una contraseña predeterminada establecida en la instalación. • https://access.redhat.com/security/cve/cve-2014-0175 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0175 https://security-tracker.debian.org/tracker/CVE-2014-0175 • CWE-798: Use of Hard-coded Credentials •
CVSS: 9.8EPSS: 1%CPEs: 12EXPL: 0CVE-2016-2788
https://notcve.org/view.php?id=CVE-2016-2788
MCollective 2.7.0 and 2.8.x before 2.8.9, as used in Puppet Enterprise, allows remote attackers to execute arbitrary code via vectors related to the mco ping command. MCollective 2.7.0 y 2.8.x en versiones anteriores a 2.8.9, como se utiliza en Puppet Enterprise, permite a atacantes remotos ejecutar código arbitrario a través de vectores relacionados con el comando mco ping. • https://puppet.com/security/cve/cve-2016-2788 • CWE-284: Improper Access Control •
CVSS: 6.2EPSS: 0%CPEs: 15EXPL: 1CVE-2014-3248
https://notcve.org/view.php?id=CVE-2014-3248
Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) rubygems/defaults/operating_system.rb, (2) Win32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, or (6) safe_yaml/deep.so; or (7) operatingsystem.rb, (8) operatingsystem.so, (9) osfamily.rb, or (10) osfamily.so in puppet/confine. Vulnerabilidad de ruta de búsqueda no confiable en Puppet Enterprise 2.8 anterior a 2.8.7, Puppet anterior a 2.7.26 y 3.x anterior a 3.6.2, Facter 1.6.x y 2.x anterior a 2.0.2, Hiera anterior a 1.3.4, y Mcollective anterior a 2.5.2 o anteriores, permite a usuarios locales ganar privilegios ubicando un troyano en el directorio actual a través de un troyano en un archivo, se demostró usando (1) rubygems/defaults/operating_system.rb, (2) Win32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, o (6) safe_yaml/deep.so; o (7) operatingsystem.rb, (8) operatingsystem.so, (9) osfamily.rb, o (10) osfamily.so en puppet/confine. • http://puppetlabs.com/security/cve/cve-2014-3248 http://rowediness.com/2014/06/13/cve-2014-3248-a-little-problem-with-puppet http://secunia.com/advisories/59197 http://secunia.com/advisories/59200 http://www.securityfocus.com/bid/68035 • CWE-17: DEPRECATED: Code •