The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them.

Computer vulnerabilities of Puppet

computer weakness note CVE-2019-10695

Puppet Enterprise cd4pe: privilege escalation via Password PE console

Synthesis of the vulnerability

An attacker can bypass restrictions via Password PE console of Puppet Enterprise cd4pe, in order to escalate his privileges.
Severity: 2/4.
Creation date: 30/07/2019.
Identifiers: CVE-2019-10695, VIGILANCE-VUL-29912.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can bypass restrictions via Password PE console of Puppet Enterprise cd4pe, in order to escalate his privileges.
Full Vigil@nce bulletin... (Free trial)

vulnerability announce CVE-2019-10241 CVE-2019-10246 CVE-2019-10247

Eclipse Jetty: Cross Site Scripting

Synthesis of the vulnerability

An attacker can trigger a Cross Site Scripting of Eclipse Jetty, in order to run JavaScript code in the context of the web site.
Severity: 2/4.
Number of vulnerabilities in this bulletin: 3.
Creation date: 23/04/2019.
Identifiers: CVE-2019-10241, CVE-2019-10246, CVE-2019-10247, NTAP-20190509-0003, VIGILANCE-VUL-29106.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

The Eclipse Jetty product offers a web service.

However, it does not filter received data before inserting them in generated HTML documents.

An attacker can therefore trigger a Cross Site Scripting of Eclipse Jetty, in order to run JavaScript code in the context of the web site.
Full Vigil@nce bulletin... (Free trial)

cybersecurity weakness CVE-2019-2420 CVE-2019-2434 CVE-2019-2435

Oracle MySQL: vulnerabilities of January 2019

Synthesis of the vulnerability

Several vulnerabilities were announced in Oracle products.
Severity: 3/4.
Number of vulnerabilities in this bulletin: 26.
Creation date: 16/01/2019.
Identifiers: bulletinapr2019, CERTFR-2019-AVI-025, cpujan2019, CVE-2019-2420, CVE-2019-2434, CVE-2019-2435, CVE-2019-2436, CVE-2019-2455, CVE-2019-2481, CVE-2019-2482, CVE-2019-2486, CVE-2019-2494, CVE-2019-2495, CVE-2019-2502, CVE-2019-2503, CVE-2019-2507, CVE-2019-2510, CVE-2019-2513, CVE-2019-2528, CVE-2019-2529, CVE-2019-2530, CVE-2019-2531, CVE-2019-2532, CVE-2019-2533, CVE-2019-2534, CVE-2019-2535, CVE-2019-2536, CVE-2019-2537, CVE-2019-2539, DLA-1655-1, FEDORA-2019-21b76d179e, openSUSE-SU-2019:0138-1, openSUSE-SU-2019:0327-1, RHSA-2019:1258-01, RHSA-2019:2327-01, RHSA-2019:2484-01, RHSA-2019:2511-01, RHSA-2019:3708-01, SSA:2019-032-01, SUSE-SU-2019:0555-1, SUSE-SU-2019:0609-1, SUSE-SU-2019:2048-1, SUSE-SU-2019:2118-1, USN-3867-1, VIGILANCE-VUL-28291.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

Several vulnerabilities were announced in Oracle products.
Full Vigil@nce bulletin... (Free trial)

computer weakness announce CVE-2018-16850

PostgreSQL: SQL injection via pg_upgrade/pg_dump

Synthesis of the vulnerability

An attacker can use a SQL injection via pg_upgrade/pg_dump of PostgreSQL, in order to read or alter data.
Severity: 2/4.
Creation date: 08/11/2018.
Revision date: 09/11/2018.
Identifiers: 528379, CVE-2018-16850, DLA-1642-1, DSA-2018-208, openSUSE-SU-2018:3893-1, openSUSE-SU-2018:4031-1, RHSA-2018:3757-01, SUSE-SU-2018:3770-1, SUSE-SU-2018:3770-2, USN-3818-1, VIGILANCE-VUL-27738.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

The PostgreSQL product uses a database.

However, user's data are directly inserted in a SQL query.

An attacker can therefore use a SQL injection via pg_upgrade/pg_dump of PostgreSQL, in order to read or alter data.
Full Vigil@nce bulletin... (Free trial)

weakness note CVE-2018-3136 CVE-2018-3139 CVE-2018-3149

Oracle Java: vulnerabilities of October 2018

Synthesis of the vulnerability

Several vulnerabilities were announced in Oracle products.
Severity: 3/4.
Number of vulnerabilities in this bulletin: 11.
Creation date: 17/10/2018.
Identifiers: 528379, CERTFR-2018-AVI-495, cpuoct2018, CVE-2018-3136, CVE-2018-3139, CVE-2018-3149, CVE-2018-3150, CVE-2018-3157, CVE-2018-3169, CVE-2018-3180, CVE-2018-3183, CVE-2018-3209, CVE-2018-3211, CVE-2018-3214, DLA-1590-1, DSA-2018-208, DSA-2019-131, DSA-4326-1, FEDORA-2018-209371341e, FEDORA-2018-369ab0efc9, FEDORA-2018-5857f28069, FEDORA-2018-cca64e06ba, FEDORA-2018-ce61c1147d, ibm10729607, ibm10741443, ibm10742147, ibm10742149, ibm10743955, ibm10793419, ibm10796096, ibm10875314, ibm10881644, ibm10882604, ibm10883400, openSUSE-SU-2018:3235-1, openSUSE-SU-2019:0042-1, openSUSE-SU-2019:0043-1, RHSA-2018:2942-01, RHSA-2018:2943-01, RHSA-2018:3000-01, RHSA-2018:3001-01, RHSA-2018:3002-01, RHSA-2018:3003-01, RHSA-2018:3007-01, RHSA-2018:3008-01, RHSA-2018:3350-01, RHSA-2018:3409-01, RHSA-2018:3521-01, RHSA-2018:3533-01, RHSA-2018:3534-01, RHSA-2018:3671-01, RHSA-2018:3672-01, SB10255, SUSE-SU-2018:3868-1, SUSE-SU-2018:3920-1, SUSE-SU-2018:3921-1, SUSE-SU-2018:3933-1, SUSE-SU-2018:4064-1, SUSE-SU-2019:0049-1, SUSE-SU-2019:0057-1, SUSE-SU-2019:0057-2, SUSE-SU-2019:0058-1, USN-3804-1, USN-3824-1, USN-3830-1, VIGILANCE-VUL-27509, ZDI-18-1263.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

Several vulnerabilities were announced in Oracle products.
Full Vigil@nce bulletin... (Free trial)

threat announce CVE-2018-11749

Puppet Enterprise: privilege escalation via RBAC Plaintext Password

Synthesis of the vulnerability

An attacker can bypass restrictions via RBAC Plaintext Password of Puppet Enterprise, in order to escalate his privileges.
Severity: 2/4.
Creation date: 24/08/2018.
Identifiers: CVE-2018-11749, VIGILANCE-VUL-27073.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can bypass restrictions via RBAC Plaintext Password of Puppet Enterprise, in order to escalate his privileges.
Full Vigil@nce bulletin... (Free trial)

computer weakness bulletin CVE-2018-10237

Guava: denial of service via AtomicDoubleArray

Synthesis of the vulnerability

An attacker can generate a fatal error via AtomicDoubleArray() of Guava, in order to trigger a denial of service.
Severity: 2/4.
Creation date: 16/08/2018.
Identifiers: CVE-2018-10237, ibm10795696, ibm10871804, RHSA-2018:2423-01, RHSA-2018:2424-01, RHSA-2018:2425-01, RHSA-2018:2740-01, RHSA-2018:2741-01, RHSA-2018:2742-01, RHSA-2018:2743-01, swg27048591, VIGILANCE-VUL-27021.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can generate a fatal error via AtomicDoubleArray() of Guava, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability alert CVE-2018-1000544

rubyzip: directory traversal via Zip-File

Synthesis of the vulnerability

An attacker can traverse directories via Zip::File of rubyzip, in order to create a file outside the service root path.
Severity: 2/4.
Creation date: 16/08/2018.
Identifiers: CVE-2018-1000544, DLA-1467-1, VIGILANCE-VUL-27010.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can traverse directories via Zip::File of rubyzip, in order to create a file outside the service root path.
Full Vigil@nce bulletin... (Free trial)

cybersecurity note CVE-2018-2938 CVE-2018-2940 CVE-2018-2941

Oracle Java: vulnerabilities of July 2018

Synthesis of the vulnerability

Several vulnerabilities were announced in Oracle products.
Severity: 3/4.
Number of vulnerabilities in this bulletin: 8.
Creation date: 18/07/2018.
Identifiers: ADV-2018-022, CERTFR-2018-AVI-348, cpujul2018, CVE-2018-2938, CVE-2018-2940, CVE-2018-2941, CVE-2018-2942, CVE-2018-2952, CVE-2018-2964, CVE-2018-2972, CVE-2018-2973, DLA-1590-1, DSA-4268-1, FEDORA-2018-0b6ccd1c68, FEDORA-2018-40decc4158, FEDORA-2018-4d58785bcd, FEDORA-2018-877fdbb3f0, FEDORA-2018-c650019e9c, FEDORA-2018-d4bfa98f6a, ibm10725491, ibm10738401, ibm10742729, ibm10743351, NTAP-20180726-0001, openSUSE-SU-2018:2206-1, openSUSE-SU-2018:2247-1, openSUSE-SU-2018:3057-1, openSUSE-SU-2018:3103-1, openSUSE-SU-2019:0042-1, RHSA-2018:2241-01, RHSA-2018:2242-01, RHSA-2018:2253-01, RHSA-2018:2254-01, RHSA-2018:2255-01, RHSA-2018:2256-01, RHSA-2018:2283-01, RHSA-2018:2286-01, RHSA-2018:2568-01, RHSA-2018:2569-01, RHSA-2018:2575-01, RHSA-2018:2576-01, RHSA-2018:3007-01, RHSA-2018:3008-01, SB10247, SUSE-SU-2018:2083-1, SUSE-SU-2018:2574-1, SUSE-SU-2018:2583-1, SUSE-SU-2018:2649-1, SUSE-SU-2018:2839-1, SUSE-SU-2018:3045-1, SUSE-SU-2018:3064-1, SUSE-SU-2018:3064-3, SUSE-SU-2018:3082-1, SUSE-SU-2019:0049-1, USN-3734-1, USN-3735-1, USN-3747-1, USN-3747-2, VIGILANCE-VUL-26767.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

Several vulnerabilities were announced in Oracle products.
Full Vigil@nce bulletin... (Free trial)

computer threat bulletin CVE-2018-11746

Puppet Discovery: information disclosure via HTTP Basic Auth

Synthesis of the vulnerability

An attacker can use a vulnerability via HTTP Basic Auth of Puppet Discovery, in order to obtain sensitive information.
Severity: 2/4.
Creation date: 03/07/2018.
Identifiers: CVE-2018-11746, VIGILANCE-VUL-26606.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

The Puppet Discovery product offers a web service.

However, an attacker can read the password in the Basic Auth if the session does not use HTTPS

An attacker can therefore use a vulnerability via HTTP Basic Auth of Puppet Discovery, in order to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)
Our database contains other pages. You can request a free trial to read them.

Display information about Puppet: