CVE-2014-3250

Removed by vendor...

CVE-2015-6502

The CVE-2015-6502 entries describe a cross-site scripting (XSS) vulnerability in Puppet Enterprise’s console, affecting versions before 2015.2.1. The vulnerability arises from the string parameter (related to Login Redirect) and allows remote injection of web script/HTML. The connected sources co...

PT-2017-5867

Name of the Vulnerable Software and Affected Versions: Puppet versions prior to 3.6.2 Description: The issue is related to the default vhost configuration file in Puppet, which does not include the SSLCARevocationCheck directive. This might allow remote attackers to obtain sensitive information v...

PT-2017-7030

Name of the Vulnerable Software and Affected Versions Puppet Enterprise versions prior to 2015.2.1 Description The issue allows remote attackers to inject arbitrary web script or HTML via the string parameter, related to Login Redirect. This is a cross-site scripting XSS vulnerability in the...

PT-2017-7408

Name of the Vulnerable Software and Affected Versions Puppet Enterprise versions 3.7.x through 3.8.x and 2015.2.x Description The issue is related to the console in Puppet Enterprise not setting the secure flag for the JSESSIONID cookie in an HTTPS session. This makes it easier for remote attacke...

CVE-2014-3250: Improper Certificate Validation

The default vhost configuration file in Puppet before 3.6.2 does not include the SSLCARevocationCheck directive, which might allow remote attackers to obtain sensitive information via a revoked certificate when a Puppet master runs with Apache 2.4...

CVE-2015-6502: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the console in Puppet Enterprise before 2015.2.1 allows remote attackers to inject arbitrary web script or HTML via the string parameter, related to Login Redirect...

CVE-2015-8470: Exposure of Sensitive Information to an Unauthorized Actor

The console in Puppet Enterprise 3.7.x, 3.8.x, and 2015.2.x does not set the secure flag for the JSESSIONID cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session...

Puppet Agent PXP agent code execution vulnerability

Puppet Agent is a set of client tools for viewing configuration files from Puppet Labs in the U.S. Puppet Execution Protocol PXP agent is one of the Puppet Execution Protocol tools. A code execution vulnerability exists in the PXP agent in Puppet Agent versions 1.3.0 through 1.5.x. The...

DEBIAN-CVE-2016-5713

Versions of Puppet Agent prior to 1.6.0 included a version of the Puppet Execution Protocol PXP agent that passed environment variables through to Puppet runs. This could allow unauthorized code to be loaded. This bug was first introduced in Puppet Agent 1.3.0...

CVE-2016-5713

Versions of Puppet Agent prior to 1.6.0 included a version of the Puppet Execution Protocol PXP agent that passed environment variables through to Puppet runs. This could allow unauthorized code to be loaded. This bug was first introduced in Puppet Agent 1.3.0...

CVE-2016-5713

Versions of Puppet Agent prior to 1.6.0 included a version of the Puppet Execution Protocol PXP agent that passed environment variables through to Puppet runs. This could allow unauthorized code to be loaded. This bug was first introduced in Puppet Agent 1.3.0...

Code injection

Versions of Puppet Agent prior to 1.6.0 included a version of the Puppet Execution Protocol PXP agent that passed environment variables through to Puppet runs. This could allow unauthorized code to be loaded. This bug was first introduced in Puppet Agent 1.3.0...

CVE-2016-5713

Versions of Puppet Agent prior to 1.6.0 included a version of the Puppet Execution Protocol PXP agent that passed environment variables through to Puppet runs. This could allow unauthorized code to be loaded. This bug was first introduced in Puppet Agent 1.3.0...

CVE-2016-5713

Versions of Puppet Agent prior to 1.6.0 included a version of the Puppet Execution Protocol PXP agent that passed environment variables through to Puppet runs. This could allow unauthorized code to be loaded. This bug was first introduced in Puppet Agent 1.3.0...

CVE-2016-5713

CVE-2016-5713 affects Puppet Agent before 1.6.0, where the Puppet Execution Protocol (PXP) agent passed environment variables to Puppet runs. This could allow unauthorized code to be loaded, with the issue introduced in Puppet Agent 1.3.0. Affected versions include 1.3.0 through 1.5.x. The docume...

CVE-2016-5713

Removed by vendor...

CVE-2016-5713

Versions of Puppet Agent prior to 1.6.0 included a version of the Puppet Execution Protocol PXP agent that passed environment variables through to Puppet runs. This could allow unauthorized code to be loaded. This bug was first introduced in Puppet Agent 1.3.0...

PT-2017-8749

Name of the Vulnerable Software and Affected Versions Puppet Agent versions prior to 1.6.0 Description The issue allows unauthorized code to be loaded due to the Puppet Execution Protocol PXP agent passing environment variables through to Puppet runs. This bug was first introduced in Puppet Agent...

CVE-2016-5713: Improper Control of Generation of Code

Versions of Puppet Agent prior to 1.6.0 included a version of the Puppet Execution Protocol PXP agent that passed environment variables through to Puppet runs. This could allow unauthorized code to be loaded. This bug was first introduced in Puppet Agent 1.3.0...