Input Validation and Logic

Every one of the 12 is a mark on the map. Named now: 1 to 12, most at risk first.

1. Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized attribute…CVE-2013-1655Puppet · 4.6% likely

   CWE-20

2. Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby cla…CVE-2013-3567Puppet · 3.4% likely

   CWE-20

3. Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and 1.2 before 1.2.4, when signing an agent certificate, adds the Puppet master's cer…CVE-2011-3872Puppet · 2.5% likely

   CWE-20

4. Puppet Enterprise before 3.0.1 does not sufficiently invalidate a session when a user logs out, which might allow remote attackers to hijack sessions by obtaining an old session I…CVE-2013-4762Puppet · 1.6% likely

   CWE-20

5. The pxp-agent component in Puppet Enterprise 2015.3.x before 2015.3.3 and Puppet Agent 1.3.x before 1.3.6 does not properly validate server certificates, which might allow remote…CVE-2016-2786Puppet · 1.6% likely

   CWE-20

6. The mcollective-sshkey-security plugin before 0.5.1 for Puppet uses a server-specified identifier as part of a path where a file is written. A compromised server could use this to…CVE-2017-2298Puppet · 1.5% likely

   CWE-20

7. The Puppet Communications Protocol (PCP) Broker incorrectly validates message header sizes. An attacker could use this to crash the PCP Broker, preventing commands from being sent…CVE-2016-9686Puppet · 1.3% likely

   CWE-20

8. Open redirect vulnerability in the login page in Puppet Enterprise before 3.0.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a…CVE-2013-4955Puppet · 1.1% likely

   CWE-20

9. Previous releases of the Puppet cisco_ios module did not validate a host's identity before starting a SSH connection. As of the 0.4.0 release of cisco_ios, host key checking is en…CVE-2018-11750Puppet · 1.1% likely

   CWE-20

10. Puppet Firewall Module May Leave Unmanaged RulesCVE-2022-0675Puppet · CVSS 5.6 · 0.9% likely

    CWE-1289

11. In Puppet Enterprise 2017.1.x and 2017.2.1, using specially formatted strings with certain formatting characters as Classifier node group names or RBAC role display names causes e…CVE-2017-2296Puppet · 0.9% likely

    CWE-20

12. Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x prior to 5.5.2 on Windows only, with a specially crafted configuration file an atta…CVE-2018-6515Puppet · 0.8% likely

    CWE-20

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.