EUVD-2018-18266

Malware in sbrugna...

EUVD-2015-5636

Malware in sbrugna...

CVE-2019-10695

When using the cd4pe::rootconfiguration task to configure a Continuous Delivery for PE installation, the root user’s username and password were exposed in the job’s Job Details pane in the PE console. These issues have been resolved in version 1.2.1 of the puppetlabs/cd4pe module...

Cross site request forgery (csrf)

Parts of the Puppet Enterprise Console 3.x were found to be susceptible to clickjacking and CSRF Cross-Site Request Forgery attacks. This would allow an attacker to redirect user input to an untrusted site or hijack a user session...

PT-2020-7869

Name of the Vulnerable Software and Affected Versions: Puppet Enterprise Console versions 3.x Description: The issue allows an attacker to perform clickjacking and CSRF Cross-Site Request Forgery attacks, potentially redirecting user input to an untrusted site or hijacking a user session...

CVE-2015-5686: Cross-Site Request Forgery (CSRF)

Parts of the Puppet Enterprise Console 3.x were found to be susceptible to clickjacking and CSRF Cross-Site Request Forgery attacks. This would allow an attacker to redirect user input to an untrusted site or hijack a user session...

Puppet Enterprise Console Cross-Site Scripting Vulnerability (CNVD-2018-09252)

Puppet is a set of configuration management tools based on client/server C/S architecture from Puppet Labs in the U.S. It can be used to manage configuration files, users, cron tasks, packages, system services, etc. Puppet Enterprise is its enterprise version.Puppet Enterprise Console is one of t...

CVE-2018-6510

A cross-site scripting vulnerability in Puppet Enterprise Console of Puppet Enterprise allows a user to inject scripts into the Puppet Enterprise Console when using the Orchestrator. Affected releases are Puppet Puppet Enterprise: 2017.3.x versions prior to 2017.3.6...

CVE-2018-6511

A cross-site scripting vulnerability in Puppet Enterprise Console of Puppet Enterprise allows a user to inject scripts into the Puppet Enterprise Console when using the Puppet Enterprise Console. Affected releases are Puppet Puppet Enterprise: 2017.3.x versions prior to 2017.3.6...

CVE-2018-6510

Removed by vendor...

CVE-2018-6510

CVE-2018-6510 describes a cross-site scripting vulnerability in Puppet Enterprise Console (used with the Orchestrator). The issue allows an attacker to inject scripts into the Puppet Enterprise Console and is tied to Puppet Enterprise: 2017.3.x versions prior to 2017.3.6. The root cause is improp...

CVE-2018-6511

A cross-site scripting vulnerability in Puppet Enterprise Console of Puppet Enterprise allows a user to inject scripts into the Puppet Enterprise Console when using the Puppet Enterprise Console. Affected releases are Puppet Puppet Enterprise: 2017.3.x versions prior to 2017.3.6...

CVE-2018-6511: Improper Neutralization of Input During Web Page Generation

A cross-site scripting vulnerability in Puppet Enterprise Console of Puppet Enterprise allows a user to inject scripts into the Puppet Enterprise Console when using the Puppet Enterprise Console. Affected releases are Puppet Puppet Enterprise: 2017.3.x versions prior to 2017.3.6...

PT-2018-17599

Name of the Vulnerable Software and Affected Versions Puppet Enterprise versions prior to 2017.3.6 Description A cross-site scripting issue in Puppet Enterprise Console of Puppet Enterprise allows a user to inject scripts into the Puppet Enterprise Console when using the Orchestrator...

CVE-2018-6510: Improper Neutralization of Input During Web Page Generation

A cross-site scripting vulnerability in Puppet Enterprise Console of Puppet Enterprise allows a user to inject scripts into the Puppet Enterprise Console when using the Orchestrator. Affected releases are Puppet Puppet Enterprise: 2017.3.x versions prior to 2017.3.6...