Puppet Enterprise 2017.x < 2017.3.6 Cross-site Scripting Vulnerability

According to its self-reported version number, the Puppet install running on the remote host is version 4.x prior to 2016.2.1, 5.3.x prior to 2017.3.7, or 5.5.x prior to 2018.1.1. It is, therefore, affected by a cross-site scripting XSS vulnerability due to improper validation of user-supplied...

Puppet Enterprise < 2017.3.4 Code Execution Vulnerability

According to its self-reported version number, the Puppet install running on the remote host is version 5.5.x prior to 2017.3.4. It is, therefore, affected by multiple vulnerabilities: - a remote code execution vulnerability due to incorrect validation of strings in the factertask or puppetconf...

Puppet Enterprise 2015.x < 2016.4.0 Denial of Service Vulnerability

According to its self-reported version number, the Puppet install running on the remote host is version 5.5.x prior to 2017.2.2. It is, therefore, affected by a denial of service DoS vulnerability which exists in the puppet communications protocol broker due to incorrect validation of message...

Puppet Enterprise 2018.x < 2018.1.1 Code Execution Vulnerability

According to its self-reported version number, the Puppet install running on the remote host is version 5.5.x prior to 2018.1.1. It is, therefore, affected by a code execution vulnerability when upgrading the pe-razor-server component. C Tenable Network Security, Inc. include"compat.inc"; if...

Puppet Enterprise < 2016.4.0 Multiple Vulnerabilities

According to its self-reported version number, the Puppet Enterprise application running on the remote host is version prior to 2016.2.1. It is, therefore, affected by the following vulnerabilities : - An information disclosure vulnerability exists in the environment catalog component. An...

Puppet Enterprise x < 2018.1.9 / 2019.x.x < 2019.0.3 Default Password Vulnerabilities

The admin account is using a default password. An unauthenticated, remote attacker can exploit this gain privileged or administrator access to the system. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid129763; scriptversion"1.4";...

Puppet Enterprise 2015.x < 2015.3.3 Multiple Vulnerabilities

According to its self-reported version number, the Puppet Enterprise application running on the remote host is version 2015.x prior to 2015.3.3. It is, therefore, affected by the following vulnerabilities : - A invalid validation of the server certificate by the pxp-agent. An unauthenticated,...

Unspecified Vulnerability in Puppet

Puppet is a set of configuration management tools based on client/server C/S architecture from Puppet Labs, which can be used to manage configuration files, users, cron tasks, packages, system services, etc. Puppet Enterprise is the enterprise version of Puppet. A security vulnerability exists in...

Puppet has an unspecified vulnerability (CNVD-2019-35839)

Puppet is a set of configuration management tools based on client/server C/S architecture from Puppet Labs, which can be used to manage configuration files, users, cron tasks, packages, system services, etc. Puppet Enterprise is the enterprise version of Puppet. A security vulnerability exists in...

Authentication Bypass

Red Hat Satellite is a systems management tool for Linux-based infrastructures. It allows for provisioning, remote management and monitoring of multiple Linux deployments with a single, centralized tool. It performs provisioning and configuration management of predefined standard operating...

Remote Code Execution

Red Hat Satellite is a systems management tool for Linux-based infrastructures. It allows for provisioning, remote management and monitoring of multiple Linux deployments with a single, centralized tool. A cross-site scripting XSS flaw was found in the way the Red Hat Satellite web interface...

CVE-2018-11747

Previously, Puppet Discovery was shipped with a default generated TLS certificate in the nginx container. In version 1.4.0, a unique certificate will be generated on installation or the user will be able to provide their own TLS certificate for ingress...

CVE-2018-11747

Previously, Puppet Discovery was shipped with a default generated TLS certificate in the nginx container. In version 1.4.0, a unique certificate will be generated on installation or the user will be able to provide their own TLS certificate for ingress...

Design/Logic Flaw

Previously, Puppet Discovery was shipped with a default generated TLS certificate in the nginx container. In version 1.4.0, a unique certificate will be generated on installation or the user will be able to provide their own TLS certificate for ingress...

CVE-2018-11747

CVE-2018-11747 concerns Puppet Discovery where the nginx container shipped with a default generated TLS certificate. The root cause is the presence of a default certificate in the container prior to the fixed implementation. The documented remediation is that in version 1.4.0 a unique certificate...

CVE-2018-11747

Previously, Puppet Discovery was shipped with a default generated TLS certificate in the nginx container. In version 1.4.0, a unique certificate will be generated on installation or the user will be able to provide their own TLS certificate for ingress...

PT-2019-8792

Name of the Vulnerable Software and Affected Versions Puppet Discovery versions prior to 1.4.0 Description The issue concerns a default generated TLS certificate in the nginx container. Previously, Puppet Discovery was shipped with this default certificate. In version 1.4.0, a unique certificate...

CVE-2018-11747: Improper Certificate Validation

Previously, Puppet Discovery was shipped with a default generated TLS certificate in the nginx container. In version 1.4.0, a unique certificate will be generated on installation or the user will be able to provide their own TLS certificate for ingress...

Information Disclosure

puppet-swift is vulnerable to information-disclosure. The vulnerability is possible as it has a flaw in the service deployment and leaves the proxy-server.conf file with world-readable permissions...

Arbitrary Code Execution

openstack-puppet-modules is vulnerable to arbitrary code execution. A known default password is configured in the pcsd daemon, allowing an attacker to gain access to the daemon and execute arbitrary shell commands as root...