CVE-2014-3249

Puppet Enterprise 2.8.x before 2.8.7 allows remote attackers to obtain sensitive information via vectors involving hiding and unhiding nodes...

CVE-2014-3249

Puppet Enterprise 2.8.x before 2.8.7 allows remote attackers to obtain sensitive information via vectors involving hiding and unhiding nodes...

CVE-2014-3249

Removed by vendor...

CVE-2014-3249: Exposure of Sensitive Information to an Unauthorized Actor

Puppet Enterprise 2.8.x before 2.8.7 allows remote attackers to obtain sensitive information via vectors involving hiding and unhiding nodes...

PT-2014-5157

Name of the Vulnerable Software and Affected Versions Puppet Enterprise versions 2.8.x through 2.8.6 Description The issue allows remote attackers to obtain sensitive information via vectors involving hiding and unhiding nodes. Recommendations For Puppet Enterprise versions 2.8.x through 2.8.6,...

openSUSE Security Update : puppet (openSUSE-SU-2012:0835-1)

Fixed bnc747657: CVE-2012-1053, CVE-2012-1054: improper privilege dropping and file handling flaws This was done by updating to the new version in stable branch. The stable branch receives only security fixes and this update does not provide any new features. - Fixed bnc755869 CVE-2012-1988:...

openSUSE Security Update : puppet (openSUSE-SU-2011:1190-1)

A directory traversal vulnerability in puppet allowed unauthenticated remote attackers to upload x.509 certificate signing requests to arbitrary locations CVE-2011-3848 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

openSUSE Security Update : puppet (openSUSE-SU-2011:1288-1)

Puppet's certificate authority issued Puppet agent certificates capable of impersonating the Puppet master. Compromised or rogue puppet agents could therefore use their certificates for MITM attacks CVE-2011-3872. Note: If you've set the 'certdnsnames' option in your master's puppet.conf file...

openSUSE Security Update : puppet (openSUSE-2013-295)

Various security issues were fixed in puppet. CVE-2013-1655 CVE-2013-2275 CVE-2013-1640 CVE-2013-1652 CVE-2013-1653 CVE-2013-1654 CVE-2013-1655 CVE-2013-2274 CVE-2013-2275 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted fr...

openSUSE Security Update : puppet (openSUSE-SU-2012:0608-1)

puppet was prone to several security issues %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2012-269. The text description of this plugin is C SUSE LLC...

openSUSE Security Update : puppet (openSUSE-SU-2012:0891-1)

puppet was updated to fix various security issues: CVEs fixed : - bnc770828 - CVE-2012-3864: puppet: authenticated clients can read arbitrary files via a flaw in puppet master - bnc770829 - CVE-2012-3865: puppet: arbitrary file delete / Denial of Service on Puppet Master by authenticated clients ...

openSUSE Security Update : puppet (openSUSE-SU-2011:1288-1)

Puppet's certificate authority issued Puppet agent certificates capable of impersonating the Puppet master. Compromised or rogue puppet agents could therefore use their certificates for MITM attacks CVE-2011-3872. Note: If you've set the 'certdnsnames' option in your master's puppet.conf file...

openSUSE Security Update : puppet (openSUSE-SU-2011:1190-1)

A directory traversal vulnerability in puppet allowed unauthenticated remote attackers to upload x.509 certificate signing requests to arbitrary locations CVE-2011-3848 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

openSUSE Security Update : puppet (openSUSE-SU-2013:1370-1)

A potential remote code execution via YAML was fixed in puppet. CVE-2013-3567 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2013-661. The text description of this plugin is C SUSE...

foreman-proxy SSL verification issue

Foreman Security reports: The smart proxy when running in an SSL-secured mode permits incoming API calls to any endpoint without requiring, or performing any verification of an SSL client certificate. This permits any client with access to the API to make requests and perform actions permitting...

CVE-2013-0210

The smart proxy Puppet run API in Foreman before 1.2.0 allows remote attackers to execute arbitrary commands via vectors related to escaping and Puppet commands...

CVE-2013-0210

The smart proxy Puppet run API in Foreman before 1.2.0 allows remote attackers to execute arbitrary commands via vectors related to escaping and Puppet commands...

Command injection

The smart proxy Puppet run API in Foreman before 1.2.0 allows remote attackers to execute arbitrary commands via vectors related to escaping and Puppet commands...

CVE-2013-0210

The smart proxy Puppet run API in Foreman before 1.2.0 allows remote attackers to execute arbitrary commands via vectors related to escaping and Puppet commands...

CVE-2013-0210

CVE-2013-0210 affects Foreman’s smart proxy Puppet run API (Foreman) prior to version 1.2.0. The issue permits remote command execution via vectors related to escaping and Puppet commands. The NVD entry assigns a base score of 7.5 (HIGH) with network attack vector and no authentication, indicatin...