Skip to contentPuppet Enterprise vulnerabilities
- puppet enterprise, puppetlabs puppet +1 moreThe pe_mcollective module in Puppet Enterprise (PE) before 2.7.1 does not properly restrict...CVE-2013-13988.5 High
- puppet enterprise, puppetlabs puppet +1 morePuppet Enterprise (PE) before 2.6.1 does not properly invalidate sessions when the session secret...CVE-2012-51584.0 Medium
- puppet dashboard, enterprise +1 moreMultiple cross-site scripting (XSS) vulnerabilities in Puppet Dashboard 1.0 before 1.2.5 and...CVE-2012-08914.3 Medium
- puppet enterprisePuppet Enterprise before 3.2.0 does not properly restrict access to node endpoints in the console...CVE-2013-49715.0 Medium
- puppet enterpriseThe master external node classification script in Puppet Enterprise before 3.2.0 does not verify...CVE-2013-49666.4 Medium
- puppet enterprise, puppetlabs puppet, canonical ubuntu linux +1 more +3 morePuppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3...CVE-2013-4969Fix available2.1 Low
- puppet enterprisePuppet Enterprise before 3.1.0 does not properly restrict the number of authentication attempts...CVE-2013-49655.0 Medium
- puppet enterpriseThe dashboard report in Puppet Enterprise before 3.0.1 allows attackers to execute arbitrary YAML...CVE-2013-49576.8 Medium
- puppet enterprisePuppet Enterprise before 3.0.1 allows remote attackers to obtain the database password via...CVE-2013-49675.0 Medium
- puppet enterprisePuppet Enterprise before 3.0.1 does not set the secure flag for the session cookie in an https...CVE-2013-49645.0 Medium
- puppet enterpriseThe reset password page in Puppet Enterprise before 3.0.1 does not force entry of the current...CVE-2013-49625.8 Medium
- puppet enterprisePuppet Enterprise before 3.0.1 includes version information for the Apache and Phusion Passenger...CVE-2013-49615.0 Medium
- puppet enterprisePuppet Enterprise before 3.0.1 uses HTTP responses that contain sensitive information without the...CVE-2013-49592.1 Low
- puppet enterprisePuppet Enterprise before 3.0.1 does not use a session timeout, which makes it easier for...CVE-2013-49586.9 Medium
- puppet, puppet enterprise +1 morePuppet Module Tool (PMT), as used in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and...CVE-2013-4956Fix available3.6 Low
- puppet enterpriseOpen redirect vulnerability in the login page in Puppet Enterprise before 3.0.1 allows remote...CVE-2013-49555.8 Medium
- puppet enterprisePuppet Enterprise before 3.0.1 does not sufficiently invalidate a session when a user logs out,...CVE-2013-47625.8 Medium
- puppet, puppet enterprise +1 morePuppet allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type serviceCVE-2013-4761Fix available5.1 Medium
- puppet, puppet enterprise, canonical ubuntu linux +2 more +4 morePuppet Improper Input Validation vulnerabilityCVE-2013-3567Fix available7.5 High
- puppet enterprise, puppetlabs puppet +1 morePuppet Labs Puppet Enterprise before 2.8.0 does not use a "randomized secret" in the CAS client...CVE-2013-27165.0 Medium
- puppet, puppet enterprise, canonical ubuntu linux +2 moreThe default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x...CVE-2013-2275Fix available4.0 Medium
- puppet, puppet enterprise +1 morePuppet 2.6.x before 2.6.18 and Puppet Enterprise 1.2.x before 1.2.7 allows remote authenticated...CVE-2013-2274Fix available6.5 Medium
- puppet, puppet enterprise +1 morePuppet Improper Input Validation vulnerabilityCVE-2013-1655Fix available7.5 High
- puppet, puppet enterprise, canonical ubuntu linux +2 morePuppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, and Puppet Enterprise 2.7.x before 2.7.2, does...CVE-2013-1654Fix available5.0 Medium
- puppet, puppet enterprise, canonical ubuntu linux +2 morePuppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1...CVE-2013-1653Fix available7.1 High
- puppet, puppet enterprise, canonical ubuntu linux +2 morePuppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1...CVE-2013-1652Fix available4.9 Medium
- puppet, puppet enterprise, canonical ubuntu linux +2 moreThe (1) template and (2) inline_template functions in the master server in Puppet before 2.6.18,...CVE-2013-1640Fix available9.0 High
- puppet enterprise, puppetlabs puppet +1 morePuppet supports use of IP addresses in certnames without warning of potential risksCVE-2012-3408Fix available2.6 Low
- puppet, puppet enterprise, canonical ubuntu linux +4 more +6 morePupper does not properly restrict characters in Common Name field of Certificate Signing RequestCVE-2012-3867Fix available4.3 Medium
- puppet, puppet enterprise +1 morePuppet allows local users to obtain sensitive configuration informationCVE-2012-3866Fix available2.1 Low
- puppet, puppet enterprise +1 morePuppet vulnerable to Path TraversalCVE-2012-3865Fix available3.5 Low
- puppet, puppet enterprise +1 morePuppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, allows remote...CVE-2012-3864Fix available4.0 Medium
- puppet, puppet enterprise +1 morePuppet allows local users to overwrite arbitrary files via a symlink attackCVE-2012-1989Fix available3.6 Low
- puppet, puppet enterprise, canonical ubuntu linux +2 more +4 morePuppet Arbitrary Command ExecutionCVE-2012-1988Fix available6.0 Medium
- puppet, puppet enterprise +1 morePuppet Denial of Service and Arbitrary File WriteCVE-2012-1987Fix available3.5 Low
- puppet, puppet enterprise, puppetlabs puppet enterprise users +2 morePuppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1...CVE-2012-1986Fix available2.1 Low
- puppet, puppet enterprise, puppetlabs puppet enterprise users +2 morePuppet uses predictable filenames, allowing arbitrary file overwriteCVE-2012-1906Fix available3.3 Low
- puppet, puppet enterprise, puppetlabs puppet enterprise users +2 morePuppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1...CVE-2012-1054Fix available4.4 Medium
- puppet, puppet enterprise, puppetlabs puppet enterprise users +2 morePuppet Privilege EscallationCVE-2012-1053Fix available6.9 Medium
- puppet, puppet enterprise, puppetlabs puppet enterprise users +2 morePuppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and...CVE-2011-3872Public exploitFix available2.6 Low