CVE-2018-6514

CVE-2018-6514 : Affected software is Puppet Agent on Windows with DLL preloading in Facter. Versions affected: Puppet Agent 1.10.x before 1.10.13; 5.3.x before 5.3.7; 5.5.x before 5.5.2. Root cause is a DLL preloading vulnerability that could lead to privilege escalation. Impact is described as h...

CVE-2018-6514

In Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, Puppet Agent 5.5.x prior to 5.5.2, Facter on Windows is vulnerable to a DLL preloading attack, which could lead to a privilege escalation...

CVE-2018-6513

The vulnerability CVE-2018-6513 affects Puppet Enterprise and Puppet Agent: unprivileged Windows agents can write custom facts due to loading shared libraries from untrusted paths, enabling privilege escalation on the next puppet run. Affected: Puppet Enterprise 2016.4.x before 2016.4.12, 2017.3....

CVE-2018-6513

Puppet Enterprise 2016.4.x prior to 2016.4.12, Puppet Enterprise 2017.3.x prior to 2017.3.7, Puppet Enterprise 2018.1.x prior to 2018.1.1, Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x prior to 5.5.2, were vulnerable to an attack where an...

CVE-2018-6513

Puppet Enterprise 2016.4.x prior to 2016.4.12, Puppet Enterprise 2017.3.x prior to 2017.3.7, Puppet Enterprise 2018.1.x prior to 2018.1.1, Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x prior to 5.5.2, were vulnerable to an attack where an...

CVE-2018-6512

Removed by vendor...

CVE-2018-6515

Removed by vendor...

CVE-2018-6513

Removed by vendor...

CVE-2018-6514

In Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, Puppet Agent 5.5.x prior to 5.5.2, Facter on Windows is vulnerable to a DLL preloading attack, which could lead to a privilege escalation...

PT-2018-17604

Name of the Vulnerable Software and Affected Versions Puppet Agent versions 1.10.x prior to 1.10.13 Puppet Agent versions 5.3.x prior to 5.3.7 Puppet Agent versions 5.5.x prior to 5.5.2 Description The issue allows an attacker to load arbitrary code with privilege escalation on Windows systems...

PT-2018-17602

Name of the Vulnerable Software and Affected Versions Puppet Enterprise versions 2016.4.x through 2016.4.11 Puppet Enterprise versions 2017.3.x through 2017.3.6 Puppet Enterprise versions 2018.1.x through 2018.1.0 Puppet Agent versions 1.10.x through 1.10.12 Puppet Agent versions 5.3.x through...

PT-2018-17601

Name of the Vulnerable Software and Affected Versions Puppet Enterprise versions prior to 2018.1.1 pe-razor-server versions prior to 1.9.0.0 razor-server versions prior to 1.9.0.0 Description The issue concerns unsafe code execution when upgrading pe-razor-server. Recommendations For Puppet...

PT-2018-17603

Name of the Vulnerable Software and Affected Versions Puppet Agent versions 1.10.x prior to 1.10.13 Puppet Agent versions 5.3.x prior to 5.3.7 Puppet Agent versions 5.5.x prior to 5.5.2 Description The issue concerns a DLL preloading attack that could lead to a privilege escalation. This attack i...

CVE-2018-6515: Improper Input Validation

Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x prior to 5.5.2 on Windows only, with a specially crafted configuration file an attacker could get pxp-agent to load arbitrary code with privilege escalation...

CVE-2018-6514: Untrusted Search Path

In Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, Puppet Agent 5.5.x prior to 5.5.2, Facter on Windows is vulnerable to a DLL preloading attack, which could lead to a privilege escalation...

CVE-2018-6512: Improper Control of Generation of Code

The previous version of Puppet Enterprise 2018.1 is vulnerable to unsafe code execution when upgrading pe-razor-server. Affected releases are Puppet Enterprise: 2018.1.x versions prior to 2018.1.1 and razor-server and pe-razor-server prior to 1.9.0.0...

CVE-2018-6513: Untrusted Search Path

Puppet Enterprise 2016.4.x prior to 2016.4.12, Puppet Enterprise 2017.3.x prior to 2017.3.7, Puppet Enterprise 2018.1.x prior to 2018.1.1, Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x prior to 5.5.2, were vulnerable to an attack where an...

CVE-2018-6514

In Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, Puppet Agent 5.5.x prior to 5.5.2, Facter on Windows is vulnerable to a DLL preloading attack, which could lead to a privilege escalation...

Puppet Enterprise Console Cross-Site Scripting Vulnerability (CNVD-2018-09252)

Puppet is a set of configuration management tools based on client/server C/S architecture from Puppet Labs in the U.S. It can be used to manage configuration files, users, cron tasks, packages, system services, etc. Puppet Enterprise is its enterprise version.Puppet Enterprise Console is one of t...

Puppet Enterprise Console Cross-Site Scripting Vulnerability (CNVD-2018-09253)

Puppet is a set of configuration management tools based on client/server C/S architecture from Puppet Labs in the U.S. It can be used to manage configuration files, users, cron tasks, packages, system services, etc. Puppet Enterprise is its enterprise version.Puppet Enterprise Console is one of t...