CVE-2013-4968

Puppet Enterprise before 3.0.1 allows remote attackers to 1 conduct clickjacking attacks via unspecified vectors related to the console, and 2 conduct cross-site scripting XSS attacks via unspecified vectors related to "live management."...

CVE-2013-4968

Puppet Enterprise before 3.0.1 allows remote attackers to 1 conduct clickjacking attacks via unspecified vectors related to the console, and 2 conduct cross-site scripting XSS attacks via unspecified vectors related to "live management."...

Cross site scripting

Puppet Enterprise before 3.0.1 allows remote attackers to 1 conduct clickjacking attacks via unspecified vectors related to the console, and 2 conduct cross-site scripting XSS attacks via unspecified vectors related to "live management."...

CVE-2013-4968

Puppet Enterprise before 3.0.1 allows remote attackers to 1 conduct clickjacking attacks via unspecified vectors related to the console, and 2 conduct cross-site scripting XSS attacks via unspecified vectors related to "live management."...

CVE-2013-4968

Puppet Enterprise before 3.0.1 allows remote attackers to 1 conduct clickjacking attacks via unspecified vectors related to the console, and 2 conduct cross-site scripting XSS attacks via unspecified vectors related to "live management."...

CVE-2013-4968

CVE-2013-4968 concerns Puppet Enterprise prior to 3.0.1. According to the provided sources, remote attackers could trigger (1) clickjacking via vectors related to the console and (2) cross-site scripting (XSS) via vectors related to “live management.” The NVD entry notes these as web-related vuln...

PT-2019-11998 · Puppet · Cd4Pe

Name of the Vulnerable Software and Affected Versions: puppetlabs/cd4pe module versions prior to 1.2.1 Description: The root user’s username and password were exposed in the job’s Job Details pane in the PE console when using the cd4pe::root configuration task to configure a Continuous Delivery f...

CloudBees Jenkins Puppet Enterprise Pipeline Plugin Input Validation Error Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Puppet Enterprise Pipeline is used in one of...

CVE-2019-10458

Jenkins Puppet Enterprise Pipeline 1.3.1 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attackers able to execute Script Security protected scripts to execute arbitrary code...

CVE-2019-10458

Jenkins Puppet Enterprise Pipeline 1.3.1 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attackers able to execute Script Security protected scripts to execute arbitrary code...

Code injection

Jenkins Puppet Enterprise Pipeline 1.3.1 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attackers able to execute Script Security protected scripts to execute arbitrary code...

CVE-2019-10458

Jenkins Puppet Enterprise Pipeline 1.3.1 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attackers able to execute Script Security protected scripts to execute arbitrary code...

CVE-2019-10458

Summary (facts from documents): Jenkins Puppet Enterprise Pipeline 1.3.1 and earlier is affected by an unsafe Script Security whitelist that can let attackers executing Script Security protected scripts run arbitrary code. Affected component: Jenkins Puppet Enterprise Pipeline plugin; vulnerable ...

PT-2019-11852 · Puppet +1 · Jenkins Puppet Enterprise Pipeline +1

Name of the Vulnerable Software and Affected Versions: Jenkins Puppet Enterprise Pipeline versions 1.3.1 and earlier Description: The issue allows attackers to execute arbitrary code if they can execute Script Security protected scripts, due to unsafe values specified in the custom Script Securit...

CVE-2016-9590

An information-disclosure flaw was discovered in Red Hat OpenStack Platform director's installation of Object Storage swift. During installation, the Puppet script responsible for deploying the service incorrectly removes and recreates the proxy-server.conf file with world-readable permissions...

Puppet Enterprise 2016.x < 2016.4.15 / 2017.x < 2017.3.10 / 2018.x < 2018.1.4 Plaintext Credential Vulnerability

A plaintext credential vulnerability exists when users are configured to use startTLS with Role-Based Access Control RBAC Lightweight Directory Access Protocol LDAP. An unauthenticated, remote attacker can exploit this to bypass authentication to see the users credentials in plaintext...

Puppet Enterprise < 2016.2.1 Multiple Vulnerabilities

According to its self-reported version number, the Puppet Enterprise application running on the remote host is version prior to 2016.2.1. It is, therefore, affected by the following vulnerabilities : - A remote code execution vulnerability exists in the mcollective puppet-agent plugin due to an...

Puppet Enterprise 2016.x < 2016.4.12 / 2017.x < 2017.3.7 / 2018.x < 2018.1.1 Arbitrary Code Execution Vulnerability

A remote code execution vulnerability exists in Windows Agents due to a privilege escalation vulnerability associated with shared libraries from untrusted paths. An authenticated, unpriviledged local attacker can write custom facts which escalate privileges on the next puppet run. CVE-2018-6513 C...

Puppet Enterprise x < 2018.1.9 / 2019.x.x < 2019.0.3 Default Password Vulnerabilities

The admin account is using a default password. An unauthenticated, remote attacker can exploit this gain privileged or administrator access to the system. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid129763; scriptversion"1.4";...

Puppet Enterprise < 2016.4.5 / 2016.5.x / 2017.1.x Multiple Vulnerabilities

According to its self-reported version number, the Puppet install on the remote host is affected by multiple vulnerabilities : - A remote command execution vulnerability exists in the MCollective plugin due to unsafe YAML deserialization. An unauthenticated, remote attacker can exploit this to...