CVSS: 5.5EPSS: 0%CPEs: 70EXPL: 0CVE-2015-1426
https://notcve.org/view.php?id=CVE-2015-1426
23 Feb 2015 — Puppet Labs Facter 1.6.0 through 2.4.0 allows local users to obtains sensitive Amazon EC2 IAM instance metadata by reading a fact for an Amazon EC2 node. Puppet Labs Facter 1.6.0 hasta 2.4.0 permite a usuarios locales obtener metadatos sensibles de la instancia Amazon EC2 IAM mediante la lectura de un hecho para un nodo de Amazon EC2. • http://puppetlabs.com/security/cve/cve-2015-1426 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.4EPSS: 0%CPEs: 15EXPL: 1CVE-2014-3248 – Gentoo Linux Security Advisory 201412-15
https://notcve.org/view.php?id=CVE-2014-3248
16 Nov 2014 — Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) rubygems/defaults/operating_system.rb, (2) Win32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, or (6) safe_yaml/deep.so; or (7)... • http://puppetlabs.com/security/cve/cve-2014-3248 • CWE-17: DEPRECATED: Code •