2016 matches found
CVE-2016-5715
Open redirect vulnerability in the Console in Puppet Enterprise 2015.x and 2016.x before 2016.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // slash slash followed by a domain in the redirect parameter. NOTE: this vulnerability exists...
CVE-2015-6501
Open redirect vulnerability in the Console in Puppet Enterprise before 2015.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the string parameter...
CVE-2016-5715
Open redirect vulnerability in the Console in Puppet Enterprise 2015.x and 2016.x before 2016.4.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a // slash slash followed by a domain in the redirect parameter. NOTE: this vulnerability exists...
Insufficient Key Length
puppet uses 1024-bit keys for their CA certificate by default, which according to GlobalSign, is insufficiently secure since 2014...
PT-2017-7029
Name of the Vulnerable Software and Affected Versions Puppet Enterprise versions prior to 2015.2.1 Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the string parameter. This can be exploited to trick users into revealing...
PT-2017-8755
Name of the Vulnerable Software and Affected Versions Openstack Puppet module for Gerrit affected versions not specified Description The issue is related to the Gerrit configuration in the Openstack Puppet module, where text/html is improperly marked as a safe mimetype. This could potentially all...
PT-2017-1213
Name of the Vulnerable Software and Affected Versions Puppet Enterprise versions 2015.x through 2016.x before 2016.4.0 Description The issue is related to an open redirect vulnerability in the Console component. This vulnerability allows remote attackers to redirect users to arbitrary web sites b...
puppet-tripleo: if ssl is enabled, traffic is open on both undercloud and overcloud
An access-control flaw was discovered in puppet-tripleo's IPtables rules management, which allowed the creation of TCP/UDP rules with empty port values. Some API services in Red Hat OpenStack Platform director are not exposed to public networks, which meant their $publicsslport value was set to...
Important: Red Hat Security Advisory: puppet-tripleo security update
An update for puppet-tripleo is now available for Red Hat OpenStack Platform 10.0 Newton. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
CVE-2016-9599
puppet-tripleo before versions 5.5.0, 6.2.0 is vulnerable to an access-control flaw in the IPtables rules management, which allowed the creation of TCP/UDP rules with empty port values. If SSL is enabled, a malicious user could use these open ports to gain access to unauthorized resources...
Puppet Enterprise 2015.x / 2016.x < 2016.4.0 Multiple Vulnerabilities
According to its self-reported version number, the Puppet Enterprise application running on the remote host is version 2015.x or 2016.x prior to 2016.4.0. It is, therefore, affected by the following vulnerabilities : - A cross-site redirection vulnerability exists within the /auth/login script du...
Puppet Enterprise Detection (HTTP)
HTTP based detection of Puppet Enterprise. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...
Puppet Enterprise < 2016.4.0 Multiple Vulnerabilities
Puppet Enterprise is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:puppet:enterprise"; if...
Puppet Enterprise User Enumeration Vulnerability
Puppet is a set of configuration management tools based on client/server C/S architecture from Puppet Labs in the U.S. It can be used to manage configuration files, users, cron tasks, packages, system services, etc. Puppet Enterprise is an enterprise version. A user enumeration vulnerability exis...
Puppet Enterprise Open Redirect Vulnerability (CNVD-2016-10427)
Puppet is a set of configuration management tools based on client/server architecture , it can be used to manage configuration files , users , cron tasks , packages , system services and so on. An open redirection vulnerability exists in Puppet Enterprise, which allows an attacker to construct a...
Puppet Enterprise Open Redirect Vulnerability
Puppet is a set of configuration management tools based on client/server architecture , it can be used to manage configuration files , users , cron tasks , packages , system services and so on. An open redirection vulnerability exists in Puppet Enterprise, which allows attackers to construct...
Puppet Enterprise Web Interface User Enumeration
Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/PUPPET-USER-ENUMERATION.txt + ISR: ApparitionSec Vendor: ============== www.puppet.com Product: =============================== Puppet Enterprise Web Interface Tested in...
Puppet Enterprise Web Interface Open Redirect
Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/PUPPET-AUTHENTICATION-REDIRECT.txt + ISR: ApparitionSec Vendor: ============== www.puppet.com Product: ================================ Puppet Enterprise Web Interface Version...