Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
153 results · page 1 of 4
Sep 15, 2026Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF pCVE-2026-91938 · Other software · FlowiseAI · reported by VulnCheckHigh 7.6
Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF protection. Attackers can provide arbitrary URLs to fetch cloud metadata, internal services, and private network resources with response content returned as document text.
- Product
- Flowise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Sep 11, 2026Affected versions of Puppet Enterprise contain a command injection vulnerability.CVE-2026-85979 · Other software · Perforce Software · reported by security@puppet.comHigh 8.6
Affected versions of Puppet Enterprise contain a command injection vulnerability. An authenticated user with Puppet administrative privileges can inject arbitrary shell commands by providing a specially crafted value for this parameter, which is passed to a shell execution context without sufficient sanitization. Because the resulting commands are executed with root privileges, successful exploitation can lead to full compromise of the affected system. It affects Puppet Enterprise 2023.8.0 through 2023.8.10 and Puppet Enterprise 2025.0.0 through 2025.11.2. This has been resolved in Puppet Enterprise 2023.8.11 and Puppet Enterprise 2025.11.3.
- Product
- Puppet Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2026An authenticated user may view private Puppet module metadata without repository read access.CVE-2026-66379 · Other software · jfrog · reported by reefs@jfrog.comMedium 4.3
An authenticated user may view private Puppet module metadata without repository read access.
- Product
- artifactory
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.jfrog.comdocs.jfrog.com
Jul 3, 2026Puppet resource_api (shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x) does not preserve the sensitive flag on parameters defined via the reCVE-2026-8804 · Other software · Perforce · reported by security@puppet.comMedium 6.7
Puppet resource_api (shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x) does not preserve the sensitive flag on parameters defined via the resource-api, causing values such as passwords to be stored in cleartext in the agent's local transaction state cache. Affected versions of the resource_api module include all versions between 1.5.0 - 1.9.1 and 2.0.0 The issue was fixed in puppet resource_api 1.9.2 and 2.0.1 released with Puppet Core 8.20.0 and PE 2023.8.10 & PE 2025.11.0.
- Product
- Puppet Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2025In Puppet Enterprise versions 2025.4.0 and 2025.5, the encryption key used for encrypting content in the Infra Assistant database was not excluded from the fileCVE-2025-10360 · Other software · Perforce · reported by security@puppet.comMedium 6.9
In Puppet Enterprise versions 2025.4.0 and 2025.5, the encryption key used for encrypting content in the Infra Assistant database was not excluded from the files gathered by Puppet backup. The key is only present on the system if the user has a Puppet Enterprise Advanced license and has enabled the Infra Assistant feature. The key is used for encrypting one particular bit of data in the Infra Assistant database: the API key for their AI provider account. This has been fixed in Puppet Enterprise version 2025.6, and release notes for 2025.6 have remediation steps for users of affected versions who can't update to the latest version.
- Product
- Puppet Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2025A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host.CVE-2025-5459 · Other software · Perforce · reported by security@puppet.comHigh 8.6
A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host. It affects Puppet Enterprise versions 2018.1.8 through 2023.8.3 and 2025.3 and has been resolved in versions 2023.8.4 and 2025.4.0.
- Product
- Puppet Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.perforce.comseclists.org
Feb 7, 2025Utilization of a module presented a security risk by allowing the deserialization of untrusted/user supplied data.CVE-2021-27017 · Other software · PuppetPu · reported by security@puppet.comMedium 6.6
Utilization of a module presented a security risk by allowing the deserialization of untrusted/user supplied data. This is resolved in the Puppet Agent 7.4.0 release.
- Product
- Puppet Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 27, 2024In versions of the PEADM Forge Module prior to 3.24.0 a security misconfiguration was discovered.CVE-2024-9160 · Other software · Puppet · reported by security@puppet.comMedium 5.4
In versions of the PEADM Forge Module prior to 3.24.0 a security misconfiguration was discovered.
- Product
- PEADM Forge Module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2024An authentication bypass vulnerability has been identified in Pulpcore when deployed with Gunicorn versions prior to 22.0, due to the puppet-pulpcore configuratCVE-2024-7923 · Other software · Red Hat · reported by Red HatCritical 9.8
An authentication bypass vulnerability has been identified in Pulpcore when deployed with Gunicorn versions prior to 22.0, due to the puppet-pulpcore configuration. This issue arises from Apache's mod_proxy not properly unsetting headers because of restrictions on underscores in HTTP headers, allowing authentication through a malformed header. This flaw impacts all active Satellite deployments (6.13, 6.14 and 6.15) which are using Pulpcore version 3.0+ and could potentially enable unauthorized users to gain administrative access.
- Product
- Red Hat Satellite 6.13 for RHEL 8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Sep 4, 2024An authentication bypass vulnerability has been identified in Foreman when deployed with External Authentication, due to the puppet-foreman configuration.CVE-2024-7012 · Other software · Red Hat · reported by Red HatCritical 9.8
An authentication bypass vulnerability has been identified in Foreman when deployed with External Authentication, due to the puppet-foreman configuration. This issue arises from Apache's mod_proxy not properly unsetting headers because of restrictions on underscores in HTTP headers, allowing authentication through a malformed header. This flaw impacts all active Satellite deployments (6.13, 6.14 and 6.15) and could potentially enable unauthorized users to gain administrative access.
- Product
- Red Hat Satellite 6.13 for RHEL 8
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.comaccess.redhat.com
Jun 17, 2024puppeteer-renderer v.3.2.0 and before is vulnerable to Directory Traversal.CVE-2024-36527 · Other software · zenato · reported by MITREMedium 6.5
puppeteer-renderer v.3.2.0 and before is vulnerable to Directory Traversal. Attackers can exploit the URL parameter using the file protocol to read sensitive information from the server.
- Product
- puppeteer_renderer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Jun 5, 2024A flaw was found in foreman-installer when puppet-candlepin is invoked cpdb with the --password parameter.CVE-2024-3716 · Other software · Red Hat · reported by Red HatMedium 6.2
A flaw was found in foreman-installer when puppet-candlepin is invoked cpdb with the --password parameter. This issue leaks the password in the process list and allows an attacker to take advantage and obtain the password.
- Product
- Red Hat Satellite 6
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Feb 29, 2024dp-golang is a Puppet module for Go installations.CVE-2024-27294 · Other software · danielparks · reported by GitHubHigh 7.3
dp-golang is a Puppet module for Go installations. Prior to 1.2.7, dp-golang could install files — including the compiler binary — with the wrong ownership when Puppet was run as root and the installed package was On macOS: Go version 1.4.3 through 1.21rc3, inclusive, go1.4-bootstrap-20170518.tar.gz, or go1.4-bootstrap-20170531.tar.gz. The user and group specified in Puppet code were ignored for files within the archive. dp-puppet version 1.2.7 will recreate installations if the owner or group of any file or directory within that installation does not match the requested owner or group
- Product
- puppet-golang
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2023Versions of Puppet Enterprise prior to 2021.7.6 and 2023.5 contain a flaw which results in broken session management for SAML implementations.CVE-2023-5309 · Other software · Puppet · reported by security@puppet.comMedium 6.8
Versions of Puppet Enterprise prior to 2021.7.6 and 2023.5 contain a flaw which results in broken session management for SAML implementations.
- Product
- Puppet Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2023In Puppet Bolt versions prior to 3.27.4, a path to escalate privileges was identified.CVE-2023-5214 · Other software · Puppet · reported by security@puppet.comMedium 6.5
In Puppet Bolt versions prior to 3.27.4, a path to escalate privileges was identified.
- Product
- Bolt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2023For certificates that utilize the auto-renew feature in Puppet Server, a flaw exists which prevents the certificates from being revoked.CVE-2023-5255 · Other software · Puppet · reported by security@puppet.comMedium 4.4
For certificates that utilize the auto-renew feature in Puppet Server, a flaw exists which prevents the certificates from being revoked.
- Product
- Puppet Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 7, 2023A privilege escalation allowing remote code execution was discovered in the orchestration service.CVE-2023-2530 · Other software · Puppet · reported by security@puppet.comCritical 9.8
A privilege escalation allowing remote code execution was discovered in the orchestration service.
- Product
- Puppet Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2023A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate validation.CVE-2023-1894 · Other software · Puppet · reported by security@puppet.comMedium 5.3
A Regular Expression Denial of Service (ReDoS) issue was discovered in Puppet Server 7.9.2 certificate validation. An issue related to specifically crafted certificate names significantly slowed down server operations.
- Product
- Puppet Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023All versions of the package puppet-facter are vulnerable to Command Injection via the getFact function due to improper input sanitization.CVE-2022-25350 · Other software · Helecloud · reported by report@snyk.ioHigh 7.4
All versions of the package puppet-facter are vulnerable to Command Injection via the getFact function due to improper input sanitization.
- Product
- Puppet-facter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsecurity.snyk.io
Oct 7, 2022Command injection is possible in the puppetlabs-mysql module prior to version 13.0.0.CVE-2022-3276 · Other software · Puppet · reported by security@puppet.comHigh 8.4
Command injection is possible in the puppetlabs-mysql module prior to version 13.0.0. A malicious actor is able to exploit this vulnerability only if they are able to provide unsanitized input to the module. This condition is rare in most deployments of Puppet and Puppet Enterprise.
- Product
- puppetlabs-mysql
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2022Command injection is possible in the puppetlabs-apt module prior to version 9.0.0.CVE-2022-3275 · Other software · Puppet · reported by security@puppet.comHigh 8.4
Command injection is possible in the puppetlabs-apt module prior to version 9.0.0. A malicious actor is able to exploit this vulnerability only if they are able to provide unsanitized input to the module. This condition is rare in most deployments of Puppet and Puppet Enterprise.
- Product
- puppetlabs-apt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Jul 19, 2022Puppet Bolt prior to version 3.24.0 will print sensitive parameters when planning a run resulting in them potentially being logged when run programmatically, suCVE-2022-2394 · Other software · Puppet · reported by security@puppet.comMedium 4.1
Puppet Bolt prior to version 3.24.0 will print sensitive parameters when planning a run resulting in them potentially being logged when run programmatically, such as via Puppet Enterprise.
- Product
- Bolt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2022In certain situations it is possible for an unmanaged rule to exist on the target system that has the same comment as the rule specified in the manifest.CVE-2022-0675 · Other software · Puppet · reported by security@puppet.comMedium 5.6
In certain situations it is possible for an unmanaged rule to exist on the target system that has the same comment as the rule specified in the manifest. This could allow for unmanaged rules to exist on the target system and leave the system in an unsafe state.
- Product
- Firewall Module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2021A flaw was divered in Puppet Enterprise and other Puppet products where sensitive plan parameters may be loggedCVE-2021-27026 · Other software · Puppet · reported by security@puppet.comMedium 4.4
A flaw was divered in Puppet Enterprise and other Puppet products where sensitive plan parameters may be logged
- Product
- Puppet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2021A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the firCVE-2021-27025 · Other software · Puppet · reported by security@puppet.comMedium 6.5
A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the first 'pluginsync'.
- Product
- Puppet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgpuppet.com
Nov 18, 2021A flaw was discovered in Continuous Delivery for Puppet Enterprise (CD4PE) that results in a user with lower privileges being able to access a Puppet EnterpriseCVE-2021-27024 · Other software · Puppet · reported by security@puppet.comHigh 8.1
A flaw was discovered in Continuous Delivery for Puppet Enterprise (CD4PE) that results in a user with lower privileges being able to access a Puppet Enterprise API token. This issue is resolved in CD4PE 4.10.0
- Product
- Continuous Delivery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2021A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host.CVE-2021-27023 · Other software · Puppet · reported by security@puppet.comCritical 9.8
A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007
- Product
- Puppet Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orgpuppet.com
Sep 7, 2021A flaw was discovered in bolt-server and ace where running a task with sensitive parameters results in those sensitive parameters being logged when they should CVE-2021-27022 · Other software · Puppet · reported by security@puppet.comMedium 4.9
A flaw was discovered in bolt-server and ace where running a task with sensitive parameters results in those sensitive parameters being logged when they should not be. This issue only affects SSH/WinRM nodes (inventory service nodes).
- Product
- Puppet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2021Puppet Enterprise presented a security risk by not sanitizing user input when doing a CSV export.CVE-2021-27020 · Other software · Puppet · reported by security@puppet.comHigh 8.8
Puppet Enterprise presented a security risk by not sanitizing user input when doing a CSV export.
- Product
- Puppet Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2021PuppetDB logging included potentially sensitive system information.CVE-2021-27019 · Other software · Puppet · reported by security@puppet.comMedium 4.3
PuppetDB logging included potentially sensitive system information.
- Product
- Puppet Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2021The mechanism which performs certificate validation was discovered to have a flaw that resulted in certificates signed by an internal certificate authority to nCVE-2021-27018 · Other software · Puppet · reported by security@puppet.comHigh 7.5
The mechanism which performs certificate validation was discovered to have a flaw that resulted in certificates signed by an internal certificate authority to not be properly validated. This issue only affects clients that are configured to utilize Tenable.sc as the vulnerability data source.
- Product
- Remediate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2021A flaw was discovered in Puppet DB, this flaw results in an escalation of privileges which allows the user to delete tables via an SQL query.CVE-2021-27021 · Other software · Puppet · reported by security@puppet.comHigh 8.8
A flaw was discovered in Puppet DB, this flaw results in an escalation of privileges which allows the user to delete tables via an SQL query.
- Product
- Puppet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2020Local registry credentials were included directly in the CD4PE deployment definition, which could expose these credentials to users who should not have access tCVE-2020-7945 · Other software · Puppet · reported by security@puppet.comMedium 5.5
Local registry credentials were included directly in the CD4PE deployment definition, which could expose these credentials to users who should not have access to them. This is resolved in Continuous Delivery for Puppet Enterprise 4.0.1.
- Product
- Continuous Delivery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2020In Continuous Delivery for Puppet Enterprise (CD4PE) before 3.4.0, changes to resources or classes containing Sensitive parameters can result in the Sensitive pCVE-2020-7944 · Other software · Puppet · reported by security@puppet.comHigh 7.7
In Continuous Delivery for Puppet Enterprise (CD4PE) before 3.4.0, changes to resources or classes containing Sensitive parameters can result in the Sensitive parameters ending up in the impact analysis report.
- Product
- Continuous Delivery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2020Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints.CVE-2020-7943 · Other software · Puppet · reported by security@puppet.comHigh 7.5
Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may contain things like hostnames. Puppet Server reports resource names and titles for defined types (which may contain sensitive information) as well as function names and class names. Previously, these endpoints were open to the local network. PE 2018.1.13 & 2019.5.0, Puppet Server 6.9.2 & 5.3.12, and PuppetDB 6.9.1 & 5.2.13 disable trapperkeeper-metrics /v1 metrics API and only allows /v2 access on localhost by default. This affects software versions: Puppet Enterprise 2018.1.x stream prior to 2018.1.13 Puppet Enterprise prior to 2019.5.0 Puppet Server prior to 6.9.2 Puppet Server prior to 5.3.12 PuppetDB prior to 6.9.1 PuppetDB prior to 5.2.13 Resolved in: Puppet Enterprise 2018.1.13 Puppet Enterprise 2019.5.0 Puppet Server 6.9.2 Puppet Server 5.3.12 PuppetDB 6.9.1 PuppetDB 5.2.13
- Product
- Puppet Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2020Parts of the Puppet Enterprise Console 3.x were found to be susceptible to clickjacking and CSRF (Cross-Site Request Forgery) attacks.CVE-2015-5686 · Other software · Puppet · reported by MITREHigh 8.8
Parts of the Puppet Enterprise Console 3.x were found to be susceptible to clickjacking and CSRF (Cross-Site Request Forgery) attacks. This would allow an attacker to redirect user input to an untrusted site or hijack a user session.
- Product
- Puppet Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2020Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate allCVE-2020-7942 · Other software · Puppet · reported by security@puppet.comMedium 6.5
Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate allowed access to everything in the infrastructure. When a node's catalog falls back to the `default` node, the catalog can be retrieved for a different node by modifying facts for the Puppet run. This issue can be mitigated by setting `strict_hostname_checking = true` in `puppet.conf` on your Puppet master. Puppet 6.13.0 and 5.5.19 changes the default behavior for strict_hostname_checking from false to true. It is recommended that Puppet Open Source and Puppet Enterprise users that are not upgrading still set strict_hostname_checking to true to ensure secure behavior. Affected software versions: Puppet 6.x prior to 6.13.0 Puppet Agent 6.x prior to 6.13.0 Puppet 5.5.x prior to 5.5.19 Puppet Agent 5.5.x prior to 5.5.19 Resolved in: Puppet 6.13.0 Puppet Agent 6.13.0 Puppet 5.5.19 Puppet Agent 5.5.19
- Product
- Puppet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 16, 2019Previous versions of Puppet Agent didn't verify the peer in the SSL connection prior to downloading the CRL.CVE-2018-11751 · Other software · Puppet · reported by security@puppet.comMedium 5.4
Previous versions of Puppet Agent didn't verify the peer in the SSL connection prior to downloading the CRL. This issue is resolved in Puppet Agent 6.4.0.
- Product
- Puppet Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2019When using the cd4pe::root_configuration task to configure a Continuous Delivery for PE installation, the root user’s username and password were exposed in the CVE-2019-10695 · Other software · Puppet · reported by security@puppet.comMedium 6.5
When using the cd4pe::root_configuration task to configure a Continuous Delivery for PE installation, the root user’s username and password were exposed in the job’s Job Details pane in the PE console. These issues have been resolved in version 1.2.1 of the puppetlabs/cd4pe module.
- Product
- Continuous Delivery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2019The express install, which is the suggested way to install Puppet Enterprise, gives the user a URL at the end of the install to set the admin password.CVE-2019-10694 · Other software · Puppet · reported by security@puppet.comCritical 9.8
The express install, which is the suggested way to install Puppet Enterprise, gives the user a URL at the end of the install to set the admin password. If they do not use that URL, there is an overlooked default password for the admin user. This was resolved in Puppet Enterprise 2019.0.3 and 2018.1.9.
- Product
- Puppet Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 11, 2019Puppet Enterprise before 3.0.1 allows remote attackers to (1) conduct clickjacking attacks via unspecified vectors related to the console, and (2) conduct crossCVE-2013-4968 · Other software · Puppet · reported by MITREMedium 6.1
Puppet Enterprise before 3.0.1 allows remote attackers to (1) conduct clickjacking attacks via unspecified vectors related to the console, and (2) conduct cross-site scripting (XSS) attacks via unspecified vectors related to "live management."
- Product
- Puppet Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpuppetlabs.compuppetlabs.com
Oct 16, 2019Jenkins Puppet Enterprise Pipeline 1.3.1 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attackers able to execute Script CVE-2019-10458 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comCritical 9.9
Jenkins Puppet Enterprise Pipeline 1.3.1 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attackers able to execute Script Security protected scripts to execute arbitrary code.
- Product
- Jenkins Puppet Enterprise Pipeline
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019Prior to version 0.3.0, chloride's use of net-ssh resulted in host fingerprints for previously unknown hosts getting added to the user's known_hosts file withouCVE-2018-6517 · Other software · Puppet · reported by security@puppet.comHigh 7.5
Prior to version 0.3.0, chloride's use of net-ssh resulted in host fingerprints for previously unknown hosts getting added to the user's known_hosts file without confirmation. In version 0.3.0 this is updated so that the user's known_hosts file is not updated by chloride.
- Product
- Chloride
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 21, 2019Previously, Puppet Discovery was shipped with a default generated TLS certificate in the nginx container.CVE-2018-11747 · Other software · Puppet · reported by security@puppet.comCritical 9.8
Previously, Puppet Discovery was shipped with a default generated TLS certificate in the nginx container. In version 1.4.0, a unique certificate will be generated on installation or the user will be able to provide their own TLS certificate for ingress.
- Product
- Puppet Discovery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgpuppet.com
Oct 2, 2018Previous releases of the Puppet cisco_ios module output SSH session debug information including login credentials to a world readable file on every run.CVE-2018-11752 · Other software · Puppet · reported by security@puppet.comMedium 5.5
Previous releases of the Puppet cisco_ios module output SSH session debug information including login credentials to a world readable file on every run. These issues have been resolved in the 0.4.0 release.
- Product
- Cisco IOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2018Previous releases of the Puppet cisco_ios module did not validate a host's identity before starting a SSH connection.CVE-2018-11750 · Other software · Puppet · reported by security@puppet.comMedium 6.5
Previous releases of the Puppet cisco_ios module did not validate a host's identity before starting a SSH connection. As of the 0.4.0 release of cisco_ios, host key checking is enabled by default.
- Product
- Cisco IOS Module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpuppet.comexchange.xforce.ibmcloud.com
Oct 2, 2018Previous releases of the Puppet device_manager module creates configuration files containing credentials that are world readable.CVE-2018-11748 · Other software · Puppet · reported by security@puppet.comHigh 7.8
Previous releases of the Puppet device_manager module creates configuration files containing credentials that are world readable. This issue has been resolved as of device_manager 2.7.0.
- Product
- Device Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 24, 2018When users are configured to use startTLS with RBAC LDAP, at login time, the user's credentials are sent via plaintext to the LDAP server.CVE-2018-11749 · Other software · Puppet · reported by security@puppet.comCritical 9.8
When users are configured to use startTLS with RBAC LDAP, at login time, the user's credentials are sent via plaintext to the LDAP server. This affects Puppet Enterprise 2018.1.3, 2017.3.9, and 2016.4.14, and is fixed in Puppet Enterprise 2018.1.4, 2017.3.10, and 2016.4.15. It scored an 8.5 CVSS score.
- Product
- Puppet Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2018In Puppet Discovery prior to 1.2.0, when running Discovery against Windows hosts, WinRM connections can fall back to using basic auth over insecure channels if CVE-2018-11746 · Other software · Puppet · reported by security@puppet.comHigh 8.6
In Puppet Discovery prior to 1.2.0, when running Discovery against Windows hosts, WinRM connections can fall back to using basic auth over insecure channels if a HTTPS server is not available. This can expose the login credentials being used by Puppet Discovery.
- Product
- Puppet Discovery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgpuppet.com
Jun 14, 2018On Windows only, with a specifically crafted configuration file an attacker could get Puppet PE client tools (aka pe-client-tools) 16.4.x prior to 16.4.6, 17.3.CVE-2018-6516 · Other software · Puppet · reported by security@puppet.comHigh 7.8
On Windows only, with a specifically crafted configuration file an attacker could get Puppet PE client tools (aka pe-client-tools) 16.4.x prior to 16.4.6, 17.3.x prior to 17.3.6, and 18.1.x prior to 18.1.2 to load arbitrary code with privilege escalation.
- Product
- pe-client-tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.