CVE-2016-2785: Improper Access Control

Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access restrictions by leveraging incorrect URL decoding...

Puppet Server and Agent Arbitrary Code Execution Vulnerability

Puppet Server and Agent are both U.S. Puppet Labs based on the client/server C/S architecture of the configuration management tool, the tool can be used to manage configuration files, users, cron tasks, packages, system services and so on. An arbitrary code execution vulnerability exists in Puppe...

Puppet Server and Agent Unauthorized Access Vulnerability

Puppet Server and Agent are both U.S. Puppet Labs based on the client/server C/S architecture of the configuration management tool, the tool can be used to manage configuration files, users, cron tasks, packages, system services and so on. An unauthorized access vulnerability exists in Puppet...

GLSA-201606-02 : Puppet Server and Agent: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201606-02 Puppet Server and Agent: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Puppet Server and Agent. Please review the CVE identifiers referenced below for details. Impact : Remote attackers,...

CVE-2015-7328

Puppet Server in Puppet Enterprise before 3.8.x before 3.8.3 and 2015.2.x before 2015.2.3 uses world-readable permissions for the private key of the Certification Authority CA certificate during the initial installation and configuration, which might allow local users to obtain sensitive...

Design/Logic Flaw

Puppet Server in Puppet Enterprise before 3.8.x before 3.8.3 and 2015.2.x before 2015.2.3 uses world-readable permissions for the private key of the Certification Authority CA certificate during the initial installation and configuration, which might allow local users to obtain sensitive...

CVE-2015-7328

Puppet Server in Puppet Enterprise before 3.8.x before 3.8.3 and 2015.2.x before 2015.2.3 uses world-readable permissions for the private key of the Certification Authority CA certificate during the initial installation and configuration, which might allow local users to obtain sensitive...

CVE-2015-7328

Removed by vendor...

CVE-2015-7328

Puppet Server in Puppet Enterprise before 3.8.x before 3.8.3 and 2015.2.x before 2015.2.3 uses world-readable permissions for the private key of the Certification Authority CA certificate during the initial installation and configuration, which might allow local users to obtain sensitive...

CVE-2015-7328: Exposure of Sensitive Information to an Unauthorized Actor

Puppet Server in Puppet Enterprise before 3.8.x before 3.8.3 and 2015.2.x before 2015.2.3 uses world-readable permissions for the private key of the Certification Authority CA certificate during the initial installation and configuration, which might allow local users to obtain sensitive...

SUSE: Security Advisory for puppet (SUSE-SU-2014:0155-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Puppet Server Contention Condition Vulnerability

Puppet is IT automation software that helps system administrators manage their infrastructure. A contention condition vulnerability exists in Puppet Server 0.2.0 that allows local users to obtain sensitive information by accessing the package installation or upgrade service...

CVE-2014-7170

Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or upgrade and the start of the service...

Race condition

Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or upgrade and the start of the service...

CVE-2014-7170

CVE-2014-7170 describes a race condition in Puppet Server 0.2.0 that lets local users access sensitive information during the window between package installation/upgrade and the service start. The root cause is a timing window in the startup/upgrade sequence that can expose data prior to proper i...

CVE-2014-7170

Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or upgrade and the start of the service...

CVE-2014-7170

Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or upgrade and the start of the service...

PT-2014-7814

Name of the Vulnerable Software and Affected Versions Puppet Server version 0.2.0 Description A race condition exists, allowing local users to obtain sensitive information by accessing it during a specific time window, namely between package installation or upgrade and the start of the service...

CVE-2014-7170: Concurrent Execution using Shared Resource with Improper Synchronization

Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or upgrade and the start of the service...

SuSE 11.2 / 11.3 Security Update : puppet / puppet, puppet-server (SAT Patch Numbers 8131 / 8132)

This puppet update fixes a remote code execution issue : - Unauthenticated Remote Code Execution Vulnerability with YAML and REST API calls bug825878, CVE-2013-3567 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from SuSE...