🚨 CVE-2016-2786
The pxp-agent component in Puppet Enterprise 2015.3.x before 2015.3.3 and Puppet Agent 1.3.x before 1.3.6 does not properly validate server certificates, which might allow remote attackers to spoof brokers and execute arbitrary commands via a crafted certificate.
🎖@cveNotify
The pxp-agent component in Puppet Enterprise 2015.3.x before 2015.3.3 and Puppet Agent 1.3.x before 1.3.6 does not properly validate server certificates, which might allow remote attackers to spoof brokers and execute arbitrary commands via a crafted certificate.
🎖@cveNotify
Puppet
CVE-2016-2786 - Incorrect Client Verification in Puppet Communications Protocol
Puppet automates away the challenges, complexity, and risk of securing and running global hybrid and cloud-native infrastructure, so you can focus on delivering the next great thing.
🚨 CVE-2013-4969
Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified files.
🎖@cveNotify
Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified files.
🎖@cveNotify
Puppet
CVE-2013-4969 (Unsafe use of temp files in File type) | Puppet
Puppet automates away the challenges, complexity, and risk of securing and running global hybrid and cloud-native infrastructure, so you can focus on delivering the next great thing.
🚨 CVE-2015-6501
Open redirect vulnerability in the Console in Puppet Enterprise before 2015.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the string parameter.
🎖@cveNotify
Open redirect vulnerability in the Console in Puppet Enterprise before 2015.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the string parameter.
🎖@cveNotify
Puppet
CVE-2015-6501 | Puppet
Puppet automates away the challenges, complexity, and risk of securing and running global hybrid and cloud-native infrastructure, so you can focus on delivering the next great thing.
🚨 CVE-2015-6502
Cross-site scripting (XSS) vulnerability in the console in Puppet Enterprise before 2015.2.1 allows remote attackers to inject arbitrary web script or HTML via the string parameter, related to Login Redirect.
🎖@cveNotify
Cross-site scripting (XSS) vulnerability in the console in Puppet Enterprise before 2015.2.1 allows remote attackers to inject arbitrary web script or HTML via the string parameter, related to Login Redirect.
🎖@cveNotify
Puppet
CVE-2015-6502 | Puppet
Puppet automates away the challenges, complexity, and risk of securing and running global hybrid and cloud-native infrastructure, so you can focus on delivering the next great thing.
🚨 CVE-2018-11749
When users are configured to use startTLS with RBAC LDAP, at login time, the user's credentials are sent via plaintext to the LDAP server. This affects Puppet Enterprise 2018.1.3, 2017.3.9, and 2016.4.14, and is fixed in Puppet Enterprise 2018.1.4, 2017.3.10, and 2016.4.15. It scored an 8.5 CVSS score.
🎖@cveNotify
When users are configured to use startTLS with RBAC LDAP, at login time, the user's credentials are sent via plaintext to the LDAP server. This affects Puppet Enterprise 2018.1.3, 2017.3.9, and 2016.4.14, and is fixed in Puppet Enterprise 2018.1.4, 2017.3.10, and 2016.4.15. It scored an 8.5 CVSS score.
🎖@cveNotify
Puppet
CVE-2018-11749 - RBAC User Authentication Request Done Over Plaintext | Puppet
Puppet automates away the challenges, complexity, and risk of securing and running global hybrid and cloud-native infrastructure, so you can focus on delivering the next great thing.
🚨 CVE-2017-2294
Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 failed to mark MCollective server private keys as sensitive (a feature added in Puppet 4.6), so key values could be logged and stored in PuppetDB. These releases use the sensitive data type to ensure this won't happen anymore.
🎖@cveNotify
Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 failed to mark MCollective server private keys as sensitive (a feature added in Puppet 4.6), so key values could be logged and stored in PuppetDB. These releases use the sensitive data type to ensure this won't happen anymore.
🎖@cveNotify
Puppet
CVE-2017-2294 - MCollective Private Keys Visible In PuppetDB
Puppet automates away the challenges, complexity, and risk of securing and running global hybrid and cloud-native infrastructure, so you can focus on delivering the next great thing.
🚨 CVE-2017-2293
Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 shipped with an MCollective configuration that allowed the package plugin to install or remove arbitrary packages on all managed agents. This release adds default configuration to not allow these actions. Customers who rely on this functionality can change this policy.
🎖@cveNotify
Versions of Puppet Enterprise prior to 2016.4.5 or 2017.2.1 shipped with an MCollective configuration that allowed the package plugin to install or remove arbitrary packages on all managed agents. This release adds default configuration to not allow these actions. Customers who rely on this functionality can change this policy.
🎖@cveNotify
Puppet
CVE-2017-2293 - MCollective Server Allows Installing Arbitrary Packages On Agents | Puppet
Puppet automates away the challenges, complexity, and risk of securing and running global hybrid and cloud-native infrastructure, so you can focus on delivering the next great thing.
🚨 CVE-2015-7330
Puppet Enterprise 2015.3 before 2015.3.1 allows remote attackers to bypass a host whitelist protection mechanism by leveraging the Puppet communications protocol.
🎖@cveNotify
Puppet Enterprise 2015.3 before 2015.3.1 allows remote attackers to bypass a host whitelist protection mechanism by leveraging the Puppet communications protocol.
🎖@cveNotify
Puppet
CVE-2015-7330 | Puppet
Puppet automates away the challenges, complexity, and risk of securing and running global hybrid and cloud-native infrastructure, so you can focus on delivering the next great thing.
🚨 CVE-2017-2296
In Puppet Enterprise 2017.1.x and 2017.2.1, using specially formatted strings with certain formatting characters as Classifier node group names or RBAC role display names causes errors, effectively causing a DOS to the service. This was resolved in Puppet Enterprise 2017.2.2.
🎖@cveNotify
In Puppet Enterprise 2017.1.x and 2017.2.1, using specially formatted strings with certain formatting characters as Classifier node group names or RBAC role display names causes errors, effectively causing a DOS to the service. This was resolved in Puppet Enterprise 2017.2.2.
🎖@cveNotify
Puppet
CVE-2017-2296 - RBAC and Classifier errors caused by specially crafted strings | Puppet
Puppet automates away the challenges, complexity, and risk of securing and running global hybrid and cloud-native infrastructure, so you can focus on delivering the next great thing.
🚨 CVE-2015-8470
The console in Puppet Enterprise 3.7.x, 3.8.x, and 2015.2.x does not set the secure flag for the JSESSIONID cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session.
🎖@cveNotify
The console in Puppet Enterprise 3.7.x, 3.8.x, and 2015.2.x does not set the secure flag for the JSESSIONID cookie in an HTTPS session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session.
🎖@cveNotify
Puppet
CVE-2015-8470 | Puppet
Puppet automates away the challenges, complexity, and risk of securing and running global hybrid and cloud-native infrastructure, so you can focus on delivering the next great thing.
🚨 CVE-2021-46451
An SQL Injection vulnerabilty exists in Sourcecodester Online Project Time Management System 1.0 via the pid parameter in the load_file function.
🎖@cveNotify
An SQL Injection vulnerabilty exists in Sourcecodester Online Project Time Management System 1.0 via the pid parameter in the load_file function.
🎖@cveNotify
GitHub
CVE-nu11secur1ty/vendors/oretnom23/2022/Online-Project-Time-Management at main · nu11secur1ty/CVE-nu11secur1ty
Contribute to nu11secur1ty/CVE-nu11secur1ty development by creating an account on GitHub.
🚨 CVE-2021-45226
An issue was discovered in COINS Construction Cloud 11.12. Due to improper validation of user-controlled HTTP headers, attackers can cause it to send password-reset e-mails pointing to arbitrary websites.
🎖@cveNotify
An issue was discovered in COINS Construction Cloud 11.12. Due to improper validation of user-controlled HTTP headers, attackers can cause it to send password-reset e-mails pointing to arbitrary websites.
🎖@cveNotify
🚨 CVE-2021-45222
An issue was discovered in COINS Construction Cloud 11.12. Due to logical flaws in the human ressources interface, it is vulnerable to privilege escalation by HR personnel.
🎖@cveNotify
An issue was discovered in COINS Construction Cloud 11.12. Due to logical flaws in the human ressources interface, it is vulnerable to privilege escalation by HR personnel.
🎖@cveNotify
www.syss.de
Multiple Schwachstellen im COINS Construction Cloud ERP (SYSS-2021-028/-029/-030/-031/-051/-052/-053)
Ein Security Advisory von IT Security Consultants Jürgen Zöller und Philipp Rieth
🚨 CVE-2021-43588
Dell EMC Data Protection Central version 19.5 contains an Improper Input Validation Vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service.
🎖@cveNotify
Dell EMC Data Protection Central version 19.5 contains an Improper Input Validation Vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service.
🎖@cveNotify
🚨 CVE-2021-36349
Dell EMC Data Protection Central versions 19.5 and prior contain a Server Side Request Forgery vulnerability in the DPC DNS client processing. A remote malicious user could potentially exploit this vulnerability, allowing port scanning of external hosts.
🎖@cveNotify
Dell EMC Data Protection Central versions 19.5 and prior contain a Server Side Request Forgery vulnerability in the DPC DNS client processing. A remote malicious user could potentially exploit this vulnerability, allowing port scanning of external hosts.
🎖@cveNotify
🚨 CVE-2021-36343
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
🎖@cveNotify
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM.
🎖@cveNotify
🚨 CVE-2022-21696
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions it is possible to change the username to that of another chat participant with an additional space character at the end of the name string. An adversary with access to the chat environment can use the rename feature to impersonate other participants by adding whitespace characters at the end of the username.
🎖@cveNotify
OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. In affected versions it is possible to change the username to that of another chat participant with an additional space character at the end of the name string. An adversary with access to the chat environment can use the rename feature to impersonate other participants by adding whitespace characters at the end of the username.
🎖@cveNotify
GitHub
GitHub is where people build software. More than 73 million people use GitHub to discover, fork, and contribute to over 200 million projects.
🚨 CVE-2022-0182
Stored cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote authenticated attacker to inject an arbitrary script via an website that uses Quiz And Survey Master.
🎖@cveNotify
Stored cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote authenticated attacker to inject an arbitrary script via an website that uses Quiz And Survey Master.
🎖@cveNotify
Quiz And Survey Master
QSM - Best WordPress Quiz and Survey Plugin
Create fun quizzes, surveys, and forms with QSM, the top WordPress quiz plugin. Boost engagement, gather insights, and effortlessly captivate your audience
🚨 CVE-2022-21372
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L).
🎖@cveNotify
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L).
🎖@cveNotify
🚨 CVE-2022-0181
Reflected cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to inject an arbitrary script via unspecified vectors.
🎖@cveNotify
Reflected cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to inject an arbitrary script via unspecified vectors.
🎖@cveNotify
Quiz And Survey Master
QSM - Best WordPress Quiz and Survey Plugin
Create fun quizzes, surveys, and forms with QSM, the top WordPress quiz plugin. Boost engagement, gather insights, and effortlessly captivate your audience
🚨 CVE-2022-0180
Cross-site request forgery (CSRF) vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to hijack the authentication of administrators and conduct arbitrary operations via a specially crafted web page.
🎖@cveNotify
Cross-site request forgery (CSRF) vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to hijack the authentication of administrators and conduct arbitrary operations via a specially crafted web page.
🎖@cveNotify
Quiz And Survey Master
QSM - Best WordPress Quiz and Survey Plugin
Create fun quizzes, surveys, and forms with QSM, the top WordPress quiz plugin. Boost engagement, gather insights, and effortlessly captivate your audience