2385 matches found
Puppet Enterprise < 3.1.0 Multiple Vulnerabilities
According to its self-reported version number, the Puppet Enterprise install on the remote host is a version prior to 3.1.0. As a result, it is reportedly affected by multiple vulnerabilities : - An error exists related to the Fiddle and DL modules, '$SAFE' level verification and object handling...
Puppet 2.7.x / 3.2.x < 2.7.23 / 3.2.4 and Enterprise 2.8.x / 3.0.x < 2.8.3 / 3.0.1 Multiple Vulnerabilities
According to its self-reported version number, the Puppet install on the remote host has multiple vulnerabilities: - By using the 'resourcetype' service, an attacker could cause Puppet to load arbitrary Ruby files from the Puppet Master node's file system. While this behavior is not enabled by...
Puppet Enterprise < 3.0.1 Multiple Vulnerabilities
According to its self-reported version number, the Puppet Enterprise install on the remote host is a version prior to 3.0.1. As a result, it reportedly has multiple vulnerabilities: - An error exists related to the included Ruby SSL client that could allow man-in-the-middle attacks. CVE-2013-4073...
Puppet Unauthenticated Remote Code Execution
According to its self-reported version number, the Puppet install on the remote host has a remote code execution vulnerability. When making REST API calls, the puppet master takes YAML from an untrusted client, deserializes it, and then calls methods on the resulting object. A YAML payload can be...
CVE-2013-4957
The dashboard report in Puppet Enterprise before 3.0.1 allows attackers to execute arbitrary YAML code via a crafted report-specific type...
CVE-2013-4965
Puppet Enterprise before 3.1.0 does not properly restrict the number of authentication attempts by a console account, which makes it easier for remote attackers to bypass intended access restrictions via a brute-force attack...
Authentication flaw
Puppet Enterprise before 3.1.0 does not properly restrict the number of authentication attempts by a console account, which makes it easier for remote attackers to bypass intended access restrictions via a brute-force attack...
CVE-2013-4957
The dashboard report in Puppet Enterprise before 3.0.1 allows attackers to execute arbitrary YAML code via a crafted report-specific type...
CVE-2013-4965
Puppet Enterprise before 3.1.0 does not properly restrict the number of authentication attempts by a console account, which makes it easier for remote attackers to bypass intended access restrictions via a brute-force attack...
CVE-2013-4957
The dashboard report in Puppet Enterprise before 3.0.1 allows attackers to execute arbitrary YAML code via a crafted report-specific type...
CVE-2013-4965
Puppet Enterprise before 3.1.0 does not properly restrict the number of authentication attempts by a console account, which makes it easier for remote attackers to bypass intended access restrictions via a brute-force attack...
CVE-2013-4957
The CVE affects Puppet Enterprise prior to 3.0.1, where the dashboard report handling allows an attacker to execute arbitrary YAML code through a crafted report-specific type. The root cause is processing of the report-specific type in the dashboard/report generation flow, enabling code execution...
CVE-2013-4965
CVE-2013-4965 affects Puppet Enterprise prior to 3.1.0. The flaw is that authentication attempts for a console account are not properly restricted, enabling brute-force attempts that can bypass access controls. The description states the issue plainly but does not provide product-specific vulnera...
CVE-2013-4965
Puppet Enterprise before 3.1.0 does not properly restrict the number of authentication attempts by a console account, which makes it easier for remote attackers to bypass intended access restrictions via a brute-force attack...
CVE-2013-4965
Removed by vendor...
PT-2013-5304
Name of the Vulnerable Software and Affected Versions Puppet Enterprise versions prior to 3.0.1 Description The issue allows attackers to execute arbitrary YAML code via a crafted report-specific type in the dashboard report. Recommendations For versions prior to 3.0.1, update to version 3.0.1 or...
PT-2013-5310
Name of the Vulnerable Software and Affected Versions Puppet Enterprise versions prior to 3.1.0 Description The issue allows remote attackers to bypass intended access restrictions via a brute-force attack due to the lack of proper restriction on the number of authentication attempts by a console...
CVE-2013-4957: Improper Control of Generation of Code
The dashboard report in Puppet Enterprise before 3.0.1 allows attackers to execute arbitrary YAML code via a crafted report-specific type...
CVE-2013-4965: Improper Authentication
Puppet Enterprise before 3.1.0 does not properly restrict the number of authentication attempts by a console account, which makes it easier for remote attackers to bypass intended access restrictions via a brute-force attack...
