Access Control

Every one of the 24 is a mark on the map. Named now: 1 to 24, most at risk first.

1. Puppet Server/PuppetDB - Sensitive Information DisclosureCVE-2020-7943Puppet · 7.7% likely

   CWE-276

2. Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access restr…CVE-2016-2785Puppet · 2.9% likely

   CWE-284

3. lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Commo…CVE-2012-3867Puppet · 2.5% likely

   CWE-264

4. MCollective 2.7.0 and 2.8.x before 2.8.9, as used in Puppet Enterprise, allows remote attackers to execute arbitrary code via vectors related to the mco ping command.CVE-2016-2788Puppet · 2.3% likely

   CWE-284

5. Puppet Enterprise 2015.3.3 and 2016.x before 2016.4.0, and Puppet Agent 1.3.6 through 1.7.0 allow remote attackers to bypass a host whitelist protection mechanism and execute arbi…CVE-2016-5714Puppet · 2.2% likely

   CWE-284

6. Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users with a valid certifi…CVE-2013-1652Puppet · 1.9% likely

   CWE-264

7. Puppet 2.6.0 through 2.6.3 does not properly restrict access to node resources, which allows remote authenticated Puppet nodes to read or modify the resources of other nodes via u…CVE-2011-0528Puppet · 1.7% likely

   CWE-264

8. The puppetlabs-stdlib module 2.1 through 3.0 and 4.1.0 through 4.5.x before 4.5.1 for Puppet 2.8.8 and earlier allows remote authenticated users to gain privileges or obtain sensi…CVE-2015-1029Puppet · 1.6% likely

   CWE-264

9. Puppet Enterprise before 3.0.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by interc…CVE-2013-4964Puppet · 1.6% likely

   CWE-264

10. Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with an autho…CVE-2012-1986Puppet · 1.5% likely

    CWE-264

11. On Windows installations of the mcollective-puppet-agent plugin, version 1.12.0, a non-administrator user can create an executable that will be executed with administrator privile…CVE-2017-2290Puppet · 1.2% likely

    CWE-732

12. Puppet Enterprise before 3.2.0 does not properly restrict access to node endpoints in the console, which allows remote attackers to obtain sensitive information via unspecified ve…CVE-2013-4971Puppet · 1.2% likely

    CWE-264

13. A privilege escalation allowing remote code execution was discovered in the orchestration service.CVE-2023-2530Puppet · 1.1% likely

    CWE-284

14. In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an environment that it was not classified to retrieve from. This was resolved in Puppet A…CVE-2017-10690Puppet · 1.0% likely

    CWE-269

15. The Puppet Communications Protocol in Puppet Enterprise 2015.3.x before 2015.3.3 does not properly validate certificates for the broker node, which allows remote non-whitelisted h…CVE-2016-2787Puppet · 0.6% likely

    CWE-284

16. lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for last_run_report.yaml, which allows local users to obtain sensit…CVE-2012-3866Puppet · 0.5% likely

    CWE-264

17. CVE-2023-5214 - Privilege Escalation in Puppet BoltCVE-2023-5214Puppet · CVSS 6.5 · 0.4% likely

    CWE-269

18. telnet.rb in Puppet 2.7.x before 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users to overwrite arbitrary files via a symlink attack on the…CVE-2012-1989Puppet · 0.4% likely

    CWE-264

19. The change_user method in the SUIDManager (lib/puppet/util/suidmanager.rb) in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x,…CVE-2012-1053Puppet · 0.4% likely

    CWE-264

20. Puppet Module Tool (PMT), as used in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, installs modules with weak…CVE-2013-4956Puppet · 0.4% likely

    CWE-264

21. Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3, when managing a user login file with the k5login resource…CVE-2012-1054Puppet · 0.4% likely

    CWE-264

22. In previous versions of Puppet Agent it was possible to install a module with world writable permissions. Puppet Agent 5.3.4 and 1.10.10 included a fix to this vulnerability.CVE-2017-10689Puppet · 0.4% likely

    CWE-269

23. Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac…CVE-2012-1906Puppet · 0.4% likely

    CWE-264

24. Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in --edit mode, uses a predictable file name, which allows local users to run arbitrary Puppet code or tri…CVE-2011-3871Puppet · 0.3% likely

    CWE-264

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.