Skip to contentPuppet vulnerabilities
Newest
- perforce puppet enterprise, puppet enterprise +1 moreVersions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 shipped with an MCollective...CVE-2017-22934.9 Medium
- puppet, puppet agent, puppetpu puppet agent +4 more +6 moreTarball permission preservation in puppetCVE-2017-10689Fix available5.5 Medium
- puppet puppetlabs-mysqlpuppetlabs-mysql 3.1.0 through 3.6.0 allow remote attackers to bypass authentication by...CVE-2015-7224Fix available9.8 Critical
- puppet enterprisePuppet Enterprise 3.7.x and 3.8.0 might allow remote authenticated users to manage certificates...CVE-2015-41006.8 Medium
- puppet enterpriseThe console in Puppet Enterprise 3.7.x, 3.8.x, and 2015.2.x does not set the secure flag for the...CVE-2015-84706.5 Medium
- puppet enterpriseCross-site scripting (XSS) vulnerability in the console in Puppet Enterprise before 2015.2.1...CVE-2015-65026.1 Medium
- puppet agent, puppetpu puppet agent +1 moreVersions of Puppet Agent prior to 1.6.0 included a version of the Puppet Execution Protocol (PXP)...CVE-2016-5713Fix available9.8 Critical
- puppet agent, enterprise +1 morePuppet Enterprise 2015.3.3 and 2016.x before 2016.4.0, and Puppet Agent 1.3.6 through 1.7.0 allow...CVE-2016-5714Fix available7.2 High
- puppet puppetlabs-apacheVersions of the puppetlabs-apache module prior to 1.11.1 and 2.1.0 make it very easy to...CVE-2017-2299Fix available7.5 High
- perforce puppet enterprise, puppet enterprise +1 moreThe console in Puppet Enterprise 2015.x and 2016.x prior to 2016.4.0 includes unsafe string reads...CVE-2016-57168.8 High
- f5 nginx, apple xcode, puppet enterprise +2 moreNginx versions since 0.5.6 up to and including 1.13.2 are vulnerable to integer overflow...CVE-2017-7529Public exploitFix availableEPSS 62.6%7.5 High
- perforce puppet enterprise, puppet enterprise +1 moreVersions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 failed to mark MCollective server...CVE-2017-22947.5 High
- puppet mcollective, mcollective-sshkey-security +1 moreThe mcollective-sshkey-security plugin before 0.5.1 for Puppet uses a server-specified identifier...CVE-2017-22986.5 Medium
- puppet mcollective, mcollective, puppet, puppet enterprise +1 moreVersions of MCollective prior to 2.10.4 deserialized YAML from agents without calling safe_load,...CVE-2017-2292Fix available9.0 Critical
- puppet, puppet server, debian linux +2 moreVersions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the...CVE-2017-2295Fix available8.2 High
- puppet mcollective-puppet-agent, mcollective-puppet-agent plugin +1 moreOn Windows installations of the mcollective-puppet-agent plugin, version 1.12.0, a non...CVE-2017-22908.8 High
- puppet enterprise, marionette collective +1 moreMCollective 2.7.0 and 2.8.x before 2.8.9, as used in Puppet Enterprise, allows remote attackers...CVE-2016-2788Fix available9.8 Critical
- puppet enterprise, puppetlabs puppet enterprise +1 moreThe Puppet Communications Protocol in Puppet Enterprise 2015.3.x before 2015.3.3 does not...CVE-2016-27875.3 Medium
- perforce puppet enterprise, puppet enterprise +1 moreThe Puppet Communications Protocol (PCP) Broker incorrectly validates message header sizes. An...CVE-2016-96865.3 Medium
- puppet enterpriseOpen redirect vulnerability in the Console in Puppet Enterprise 2015.x and 2016.x before 2016.4.0...CVE-2016-57156.1 Medium
- puppet enterpriseOpen redirect vulnerability in the Console in Puppet Enterprise before 2015.2.1 allows remote...CVE-2015-65016.1 Medium
- puppet agent, enterprise +1 moreThe pxp-agent component in Puppet Enterprise 2015.3.x before 2015.3.3 and Puppet Agent 1.3.x...CVE-2016-27869.8 Critical
- puppet, puppet agent, server +2 morePuppet Improper Access ControlCVE-2016-2785Fix available9.8 Critical
- puppet enterprisePuppet Enterprise 2015.3 before 2015.3.1 allows remote attackers to bypass a host whitelist...CVE-2015-73308.8 High
- puppet enterprisePuppet Server in Puppet Enterprise before 3.8.x before 3.8.3 and 2015.2.x before 2015.2.3 uses...CVE-2015-73284.7 Medium
- hackerone ruby, debian linux, puppet agent +2 more +4 moreverify_certificate_identity in the OpenSSL extension in Ruby before 2.0.0 patchlevel 645, 2.1.x...CVE-2015-1855Public exploitFix available5.9 Medium
- puppet facterPuppet Labs Facter allows local users to obtain sensitive Amazon EC2 IAM instance metadataCVE-2015-1426Fix available2.1 Low
- puppet stdlibThe puppetlabs-stdlib module 2.1 through 3.0 and 4.1.0 through 4.5.x before 4.5.1 for Puppet 2.8...CVE-2015-1029Fix available6.5 Medium
- puppet enterprisePuppet Enterprise before 3.7.1 allows remote authenticated users to obtain licensing and...CVE-2014-93554.0 Medium
- puppet serverRace condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by...CVE-2014-71701.9 Low
- puppet enterprise, puppetlabs mcollective +1 moreThe MCollective aes_security plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective...CVE-2014-3251Fix available4.4 Medium
- puppet, redhat linux +1 moreThe default vhost configuration file in Puppet before 3.6.2 does not include the...CVE-2014-3250Fix available6.5 Medium
- puppet facter, hiera, puppet +2 more +4 morefacter, hiera, mcollective-client, and puppet affected by untrusted search path vulnerabilityCVE-2014-3248Fix available6.2 Medium
- puppet enterprisePuppet Enterprise 2.8.x before 2.8.7 allows remote attackers to obtain sensitive information via...CVE-2014-32495.0 Medium
- puppet enterpriseMultiple cross-site request forgery (CSRF) vulnerabilities in Puppet Enterprise (PE) before 3.0.1...CVE-2013-49636.8 Medium
- puppet enterprise, puppetlabs puppet +1 moreMultiple cross-site request forgery (CSRF) vulnerabilities in the (1) node request management, (2...CVE-2013-13996.8 Medium
- puppet enterprise, puppetlabs puppet +1 moreThe pe_mcollective module in Puppet Enterprise (PE) before 2.7.1 does not properly restrict...CVE-2013-13988.5 High
- puppet enterprise, puppetlabs puppet +1 morePuppet Enterprise (PE) before 2.6.1 does not properly invalidate sessions when the session secret...CVE-2012-51584.0 Medium
- puppet dashboard, enterprise +1 moreMultiple cross-site scripting (XSS) vulnerabilities in Puppet Dashboard 1.0 before 1.2.5 and...CVE-2012-08914.3 Medium
- puppet enterprisePuppet Enterprise before 3.2.0 does not properly restrict access to node endpoints in the console...CVE-2013-49715.0 Medium
- puppet enterpriseThe master external node classification script in Puppet Enterprise before 3.2.0 does not verify...CVE-2013-49666.4 Medium
- puppetPuppet does not properly restrict access to node resourcesCVE-2011-0528Fix available5.5 Medium
- puppet enterprise, puppetlabs puppet, canonical ubuntu linux +1 more +3 morePuppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3...CVE-2013-4969Fix available2.1 Low
- puppet enterprisePuppet Enterprise before 3.1.0 does not properly restrict the number of authentication attempts...CVE-2013-49655.0 Medium
- puppet enterpriseThe dashboard report in Puppet Enterprise before 3.0.1 allows attackers to execute arbitrary YAML...CVE-2013-49576.8 Medium
- puppet enterprisePuppet Enterprise before 3.0.1 allows remote attackers to obtain the database password via...CVE-2013-49675.0 Medium
- puppet enterprisePuppet Enterprise before 3.0.1 does not set the secure flag for the session cookie in an https...CVE-2013-49645.0 Medium
- puppet enterpriseThe reset password page in Puppet Enterprise before 3.0.1 does not force entry of the current...CVE-2013-49625.8 Medium
- puppet enterprisePuppet Enterprise before 3.0.1 includes version information for the Apache and Phusion Passenger...CVE-2013-49615.0 Medium
- puppet enterprisePuppet Enterprise before 3.0.1 uses HTTP responses that contain sensitive information without the...CVE-2013-49592.1 Low
- Show moreLoading…