CVE-2015-5686

Puppet Enterprise Console 3.x is affected by CSRF and clickjacking vulnerabilities leading to possible session hijacking or redirection of user input to untrusted sites. This CVE (CVE-2015-5686) is corroborated by multiple sources in connected documents (e.g., CNVD-2020-17190 and NVD entries) des...

CVE-2021-27021

CVE-2021-27021 affects Puppet DB. A flaw enables privilege escalation that allows a user to delete tables via an SQL query. This is corroborated across NVD, OSV, Nessus/NASL plugins, and OSV Debian/Ubuntu entries. The connected documents do not specify affected versions, root cause details, explo...

CVE-2018-6508

CVE-2018-6508 affects Puppet Enterprise 2017.3.x before 2017.3.3. It is a remote code execution vulnerability caused by accepting a specially crafted string in the facter_task or puppet_conf tasks. The issue only impacts the affected tasks/modules; if puppet tasks are not used, you may not be aff...

CVE-2013-1398

CVE-2013-1398 concerns the pe_mcollective module in Puppet Enterprise (PE) prior to version 2.7.1. The issue is that access to a catalog of private SSL keys is not properly restricted, allowing remote authenticated users to obtain sensitive information and potentially gain privileges by leveragin...

CVE-2018-6513

The vulnerability CVE-2018-6513 affects Puppet Enterprise and Puppet Agent: unprivileged Windows agents can write custom facts due to loading shared libraries from untrusted paths, enabling privilege escalation on the next puppet run. Affected: Puppet Enterprise 2016.4.x before 2016.4.12, 2017.3....

CVE-2016-5716

CVE-2016-5716 affects Puppet Enterprise 2015.x and 2016.x prior to 2016.4.0. The vulnerability stems from unsafe string reads in the console, which potentially permits remote code execution on the console node. The issue has been reported across multiple sources (NVD entry and CNVD/CVE records) w...

CVE-2021-27020

CVE-2021-27020 affects Puppet Enterprise prior to 2019.8.6, where unsanitized user input during CSV export leads to a security risk. Root cause: input not sanitized in CSV export path. Impact: data exposure/compromise as described; no explicit exploitation details provided in the documents. Mitig...

CVE-2015-7330

Puppet Enterprise 2015.3 before 2015.3.1 is affected by CVE-2015-7330: a remote attacker can bypass the host whitelist protection mechanism by leveraging the Puppet communications protocol. The issue concerns the host-whitelist protection and is exploitable remotely via the Puppet communications ...

CVE-2025-5459

The CVE-2025-5459 entry affects Puppet Enterprise: versions 2018.1.8–2023.8.3 and 2025.3 are vulnerable due to a misused node group editing permission and a crafted class parameter that could allow commands to run with root privileges on the primary host. It has been fixed in Puppet Enterprise 20...