Puppet Enterprise vulnerabilities

• perforce puppet enterprise, puppet enterprise +1 more OS Command Injection CVE-2025-5459 8.6 HighJune 26, 2025
• perforce puppet enterprise, puppet enterprise +1 more Broken Session Management in Puppet Enterprise CVE-2023-5309 6.8 MediumNovember 7, 2023
• puppet server, perforce puppet enterprise, puppet enterprise +2 more Denial of Service for Revocation of Auto Renewed Certificates CVE-2023-5255 4.4 MediumOctober 3, 2023
• perforce puppet enterprise, puppet enterprise +1 more A privilege escalation allowing remote code execution was discovered in the orchestration service. CVE-2023-2530 9.8 CriticalJune 7, 2023
• puppet server, perforce puppet enterprise, puppet enterprise +2 more A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2... CVE-2023-1894 Fix available 5.3 MediumMay 4, 2023
• puppet agent, server, fedoraproject fedora +1 more +3 more Unsafe HTTP Redirect in Puppet Agent and Puppet Server CVE-2021-27023 Fix available 9.8 CriticalNovember 18, 2021
• puppet, puppet agent, fedoraproject fedora +1 more +3 more Silent Configuration Failure in Puppet Agent CVE-2021-27025 Fix available 6.5 MediumNovember 18, 2021
• puppet, puppet enterprise, connect +2 more A flaw was divered in Puppet Enterprise and other Puppet products where sensitive plan parameters... CVE-2021-27026 4.4 MediumNovember 18, 2021
• perforce puppet enterprise, puppet, puppet enterprise +2 more A flaw was discovered in bolt-server and ace where running a task with sensitive parameters... CVE-2021-27022 4.9 MediumSeptember 7, 2021
• puppet puppetdb, enterprise +1 more PuppetDB logging included potentially sensitive system information. CVE-2021-27019 Fix available 4.3 MediumAugust 30, 2021
• perforce puppet enterprise, puppet enterprise +1 more Puppet Enterprise presented a security risk by not sanitizing user input when doing a CSV export. CVE-2021-27020 8.8 HighAugust 30, 2021
• puppet, puppet enterprise, puppetdb +2 more A flaw was discovered in Puppet DB, this flaw results in an escalation of privileges which allows... CVE-2021-27021 Fix available 8.8 HighJuly 20, 2021
• perforce puppet enterprise, puppet server, enterprise +1 more +3 more Puppet Server and PuppetDB provide useful performance and debugging information via their metrics... CVE-2020-7943 Fix available 7.5 HighMarch 11, 2020
• puppet enterprise Parts of the Puppet Enterprise Console 3.x were found to be susceptible to clickjacking and CSRF ... CVE-2015-5686 8.8 HighFebruary 27, 2020
• perforce puppet enterprise, puppet enterprise +1 more The express install, which is the suggested way to install Puppet Enterprise, gives the user a... CVE-2019-10694 9.8 CriticalDecember 11, 2019
• puppet enterprise Puppet Enterprise before 3.0.1 allows remote attackers to (1) conduct clickjacking attacks via... CVE-2013-4968 6.1 MediumDecember 11, 2019
• perforce puppet enterprise, puppet enterprise +1 more When users are configured to use startTLS with RBAC LDAP, at login time, the user's credentials... CVE-2018-11749 9.8 CriticalAugust 24, 2018
• puppet pe-client-tools, enterprise client tools +1 more On Windows only, with a specifically crafted configuration file an attacker could get Puppet PE... CVE-2018-6516 7.8 HighJune 14, 2018
• puppet, puppet enterprise, enterprise and puppet agent +2 more Puppet Enterprise 2016.4.x prior to 2016.4.12, Puppet Enterprise 2017.3.x prior to 2017.3.7,... CVE-2018-6513 8.8 HighJune 11, 2018
• puppet pe-razor-server, enterprise, razor-server +1 more +3 more The previous version of Puppet Enterprise 2018.1 is vulnerable to unsafe code execution when... CVE-2018-6512 9.8 CriticalJune 11, 2018
• perforce puppet enterprise, puppet enterprise +1 more XSS Vulnerability in Puppet Enterprise Console CVE-2018-6511 5.4 MediumMay 8, 2018
• perforce puppet enterprise, puppet enterprise +1 more XSS Vulnerability in Puppet Enterprise Console CVE-2018-6510 5.4 MediumMay 8, 2018
• perforce puppet enterprise, puppet enterprise, puppetlabs/apache +4 more +6 more Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a... CVE-2018-6508 Fix available 8.0 HighFebruary 9, 2018
• perforce puppet enterprise, puppet, puppet agent +3 more +5 more In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an... CVE-2017-10690 6.5 MediumFebruary 9, 2018
• perforce puppet enterprise, puppet enterprise +1 more Puppet Enterprise versions prior to 2016.4.5 and 2017.2.1 did not correctly authenticate users... CVE-2017-2297 7.5 HighFebruary 1, 2018
• perforce puppet enterprise, puppet enterprise +1 more In Puppet Enterprise 2017.1.x and 2017.2.1, using specially formatted strings with certain... CVE-2017-2296 6.5 MediumFebruary 1, 2018
• perforce puppet enterprise, puppet enterprise +1 more Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 shipped with an MCollective... CVE-2017-2293 4.9 MediumFebruary 1, 2018
• puppet, puppet agent, puppetpu puppet agent +4 more +6 more Tarball permission preservation in puppet CVE-2017-10689 Fix available 5.5 MediumDecember 31, 2017
• puppet enterprise Puppet Enterprise 3.7.x and 3.8.0 might allow remote authenticated users to manage certificates... CVE-2015-4100 6.8 MediumDecember 21, 2017
• puppet enterprise The console in Puppet Enterprise 3.7.x, 3.8.x, and 2015.2.x does not set the secure flag for the... CVE-2015-8470 6.5 MediumDecember 11, 2017
• puppet enterprise Cross-site scripting (XSS) vulnerability in the console in Puppet Enterprise before 2015.2.1... CVE-2015-6502 6.1 MediumDecember 11, 2017
• puppet agent, enterprise +1 more Puppet Enterprise 2015.3.3 and 2016.x before 2016.4.0, and Puppet Agent 1.3.6 through 1.7.0 allow... CVE-2016-5714 Fix available 7.2 HighOctober 18, 2017
• perforce puppet enterprise, puppet enterprise +1 more The console in Puppet Enterprise 2015.x and 2016.x prior to 2016.4.0 includes unsafe string reads... CVE-2016-5716 8.8 HighAugust 9, 2017
• f5 nginx, apple xcode, puppet enterprise +2 more Nginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow... CVE-2017-7529 Public exploitFix available EPSS 62.6% 7.5 HighJuly 11, 2017
• perforce puppet enterprise, puppet enterprise +1 more Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 failed to mark MCollective server... CVE-2017-2294 7.5 HighJuly 5, 2017
• puppet enterprise, marionette collective +1 more MCollective 2.7.0 and 2.8.x before 2.8.9, as used in Puppet Enterprise, allows remote attackers... CVE-2016-2788 Fix available 9.8 CriticalFebruary 13, 2017
• puppet enterprise, puppetlabs puppet enterprise +1 more The Puppet Communications Protocol in Puppet Enterprise 2015.3.x before 2015.3.3 does not... CVE-2016-2787 5.3 MediumFebruary 13, 2017
• perforce puppet enterprise, puppet enterprise +1 more The Puppet Communications Protocol (PCP) Broker incorrectly validates message header sizes. An... CVE-2016-9686 5.3 MediumFebruary 8, 2017
• puppet enterprise Open redirect vulnerability in the Console in Puppet Enterprise 2015.x and 2016.x before 2016.4.0... CVE-2016-5715 6.1 MediumJanuary 12, 2017
• puppet enterprise Open redirect vulnerability in the Console in Puppet Enterprise before 2015.2.1 allows remote... CVE-2015-6501 6.1 MediumJanuary 12, 2017
• puppet agent, enterprise +1 more The pxp-agent component in Puppet Enterprise 2015.3.x before 2015.3.3 and Puppet Agent 1.3.x... CVE-2016-2786 9.8 CriticalJune 10, 2016
• puppet enterprise Puppet Enterprise 2015.3 before 2015.3.1 allows remote attackers to bypass a host whitelist... CVE-2015-7330 8.8 HighApril 11, 2016
• puppet enterprise Puppet Server in Puppet Enterprise before 3.8.x before 3.8.3 and 2015.2.x before 2015.2.3 uses... CVE-2015-7328 4.7 MediumJanuary 8, 2016
• hackerone ruby, debian linux, puppet agent +2 more +4 more verify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x... CVE-2015-1855 Public exploitFix available 5.9 MediumApril 9, 2015
• puppet enterprise Puppet Enterprise before 3.7.1 allows remote authenticated users to obtain licensing and... CVE-2014-9355 4.0 MediumDecember 19, 2014
• puppet enterprise, puppetlabs mcollective +1 more The MCollective aes_security plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective... CVE-2014-3251 Fix available 4.4 MediumAugust 12, 2014
• puppet facter, hiera, puppet +2 more +4 more facter, hiera, mcollective-client, and puppet affected by untrusted search path vulnerability CVE-2014-3248 Fix available 6.2 MediumJune 30, 2014
• puppet enterprise Puppet Enterprise 2.8.x before 2.8.7 allows remote attackers to obtain sensitive information via... CVE-2014-3249 5.0 MediumJune 17, 2014
• puppet enterprise Multiple cross-site request forgery (CSRF) vulnerabilities in Puppet Enterprise (PE) before 3.0.1... CVE-2013-4963 6.8 MediumMarch 14, 2014
• puppet enterprise, puppetlabs puppet +1 more Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) node request management, (2... CVE-2013-1399 6.8 MediumMarch 14, 2014
• Show olderLoading…