Information disclosure

Puppet Enterprise 2.8.x before 2.8.7 allows remote attackers to obtain sensitive information via vectors involving hiding and unhiding nodes...

CVE-2014-3249

CVE-2014-3249 affects Puppet Enterprise 2.8.x before 2.8.7. The vulnerability is an information-disclosure issue allowing remote attackers to obtain sensitive information via vectors involving hiding and unhiding nodes. The NVD entry documents a MEDIUM severity (CVSS2 base score 5.0) with network...

CVE-2014-3249

Puppet Enterprise 2.8.x before 2.8.7 allows remote attackers to obtain sensitive information via vectors involving hiding and unhiding nodes...

CVE-2014-3249

Removed by vendor...

Puppet Enterprise Multiple XSS Vulnerabilities

According to its self-reported version number, the Puppet Enterprise install on the remote host is later than version 1.0 but prior to 1.2.5 / 2.0.1. It is, therefore, affected by multiple cross-site scripting vulnerabilities. Multiple cross-site scripting flaws exist where unspecified input is n...

Puppet Enterprise 2.x < 2.6.1 Session Handling Weakness

According to its self-reported version number, the Puppet Enterprise 2.x install on the remote host is prior to 2.6.1. As a result, it is reportedly affected by a session handling weakness. An error exists related to session handling, session secret regeneration, and a lack of proper termination ...

Puppet Enterprise 3.x < 3.2.0 Multiple Vulnerabilities

According to its self-reported version number, the Puppet Enterprise 3.x install on the remote host is prior to 3.2.0. As a result, it is reportedly affected by multiple vulnerabilities : - An error exists related to the PE consoles and identity verification that could allow security bypasses...

Puppet Enterprise 3.x < 3.1.2 DTLS Retransmission DoS

According to its self-reported version number, the Puppet Enterprise 3.x install on the remote host is prior to 3.1.2. As a result, it is reportedly affected by an error related to the included OpenSSL version and DTLS retransmission processing that could allow denial of service attacks...

Puppet Enterprise 3.x < 3.1.3 LibYAML Heap-Based Buffer Overflow

According to its self-reported version number, the Puppet Enterprise 3.x install on the remote host is prior to 3.1.3. As a result, it is reportedly affected by an error related to the included LibYAML version, the 'yamlparserscantaguri' function and YAML tag parsing that could allow a heap-based...

Puppet Enterprise 3.x < 3.1.1 Multiple Vulnerabilities

According to its self-reported version number, the Puppet Enterprise 3.x install on the remote host is prior to 3.1.1. As a result, it is reportedly affected by multiple vulnerabilities : - An input validation error exists related to the included Ruby version, handling string to floating point...

CVE-2013-4963

Multiple cross-site request forgery CSRF vulnerabilities in Puppet Enterprise PE before 3.0.1 allow remote attackers to hijack the authentication of users for requests that deleting a 1 report, 2 group, or 3 class or possibly have other unspecified impact...

CVE-2013-1398

The pemcollective module in Puppet Enterprise PE before 2.7.1 does not properly restrict access to a catalog of private SSL keys, which allows remote authenticated users to obtain sensitive information and gain privileges by leveraging root access to a node, related to the master role...

CVE-2012-5158

Puppet Enterprise PE before 2.6.1 does not properly invalidate sessions when the session secret has changed, which allows remote authenticated users to retain access via unspecified vectors...

CVE-2013-1399

Multiple cross-site request forgery CSRF vulnerabilities in the 1 node request management, 2 live management, and 3 user administration components in the console in Puppet Enterprise PE before 2.7.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors...

Design/Logic Flaw

The pemcollective module in Puppet Enterprise PE before 2.7.1 does not properly restrict access to a catalog of private SSL keys, which allows remote authenticated users to obtain sensitive information and gain privileges by leveraging root access to a node, related to the master role...

Design/Logic Flaw

Puppet Enterprise PE before 2.6.1 does not properly invalidate sessions when the session secret has changed, which allows remote authenticated users to retain access via unspecified vectors...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the 1 node request management, 2 live management, and 3 user administration components in the console in Puppet Enterprise PE before 2.7.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Puppet Enterprise PE before 3.0.1 allow remote attackers to hijack the authentication of users for requests that deleting a 1 report, 2 group, or 3 class or possibly have other unspecified impact...

CVE-2013-1399

CVE-2013-1399 affects Puppet Enterprise before 2.7.1, with CSRF vulnerabilities in the console’s node request management, live management, and user administration components. The flaws may allow remote attackers to hijack authentication of unspecified victims via unknown vectors. The NVD describe...

CVE-2012-5158

Puppet Enterprise PE before 2.6.1 does not properly invalidate sessions when the session secret has changed, which allows remote authenticated users to retain access via unspecified vectors...