2385 matches found
CVE-2013-1398: Undefined Security Weakness
The pemcollective module in Puppet Enterprise PE before 2.7.1 does not properly restrict access to a catalog of private SSL keys, which allows remote authenticated users to obtain sensitive information and gain privileges by leveraging root access to a node, related to the master role...
CVE-2013-4963: Cross-Site Request Forgery (CSRF)
Multiple cross-site request forgery CSRF vulnerabilities in Puppet Enterprise PE before 3.0.1 allow remote attackers to hijack the authentication of users for requests that deleting a 1 report, 2 group, or 3 class or possibly have other unspecified impact...
CVE-2013-1399: Cross-Site Request Forgery (CSRF)
Multiple cross-site request forgery CSRF vulnerabilities in the 1 node request management, 2 live management, and 3 user administration components in the console in Puppet Enterprise PE before 2.7.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors...
CVE-2012-0891: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in Puppet Dashboard 1.0 before 1.2.5 and Enterprise 1.0 before 1.2.5 and 2.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified fields...
PT-2014-2210
Name of the Vulnerable Software and Affected Versions Puppet Dashboard versions 1.0 through 1.2.5 Puppet Enterprise versions 1.0 through 1.2.5 Puppet Enterprise versions 2.x through 2.0.1 Description The issue allows remote attackers to inject arbitrary web script or HTML via unspecified fields,...
PT-2014-2472
Name of the Vulnerable Software and Affected Versions Puppet Enterprise versions prior to 2.7.1 Description The issue concerns improper access restriction to a catalog of private SSL keys. This allows remote authenticated users with root access to a node to obtain sensitive information and gain...
PT-2014-2473
Name of the Vulnerable Software and Affected Versions Puppet Enterprise PE versions prior to 2.7.1 Description The issue affects the node request management, live management, and user administration components in the console, allowing remote attackers to hijack the authentication of victims via...
PT-2014-2880
Name of the Vulnerable Software and Affected Versions Puppet Enterprise PE versions prior to 3.0.1 Description The issue affects Puppet Enterprise, allowing remote attackers to hijack user authentication for various requests, including deleting reports, groups, or classes, potentially having othe...
PT-2014-2300
Name of the Vulnerable Software and Affected Versions Puppet Enterprise PE versions prior to 2.6.1 Description The issue allows remote authenticated users to retain access via unspecified vectors when the session secret has changed, due to improper session invalidation. Recommendations For versio...
CVE-2013-4966
The master external node classification script in Puppet Enterprise before 3.2.0 does not verify the identity of consoles, which allows remote attackers to create arbitrary classifications on the master by spoofing a console...
CVE-2013-4971
Puppet Enterprise before 3.2.0 does not properly restrict access to node endpoints in the console, which allows remote attackers to obtain sensitive information via unspecified vectors...
Design/Logic Flaw
The master external node classification script in Puppet Enterprise before 3.2.0 does not verify the identity of consoles, which allows remote attackers to create arbitrary classifications on the master by spoofing a console...
Information disclosure
Puppet Enterprise before 3.2.0 does not properly restrict access to node endpoints in the console, which allows remote attackers to obtain sensitive information via unspecified vectors...
CVE-2013-4966
The master external node classification script in Puppet Enterprise before 3.2.0 does not verify the identity of consoles, which allows remote attackers to create arbitrary classifications on the master by spoofing a console...
CVE-2013-4971
Puppet Enterprise before 3.2.0 does not properly restrict access to node endpoints in the console, which allows remote attackers to obtain sensitive information via unspecified vectors...
CVE-2013-4966
Puppet Enterprise before 3.2.0 is affected: the master external node classification script does not verify the identity of consoles, which allows remote attackers to spoof a console and create arbitrary classifications on the master. Affected: Puppet Enterprise 3.x prior to 3.2.0. Root cause: mis...
CVE-2013-4971
CVE-2013-4971 affects Puppet Enterprise before 3.2.0. The vulnerability is an information disclosure caused by improper restriction of access to node endpoints in the console, enabling remote attackers to obtain sensitive data via unspecified vectors. The connected Nessus entry notes this CVE alo...
CVE-2013-4966
The master external node classification script in Puppet Enterprise before 3.2.0 does not verify the identity of consoles, which allows remote attackers to create arbitrary classifications on the master by spoofing a console...
