Mcollective

2 CVEs product

Monthly

Sort: Newest CVSS Score EPSS Score Oldest

CVE-2017-2292 Jun 30, 20:29 CRITICAL Act Now

Versions of MCollective prior to 2.10.4 deserialized YAML from agents without calling safe_load, allowing the potential for arbitrary code execution on the server. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

RCE Deserialization Puppet Mcollective

NVD

CVSS 3.0

9.0

EPSS

1.8%

CVE-2014-3251 Aug 12, 23:55 MEDIUM This Month

The MCollective aes_security plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective before 2.5.3, does not properly validate new server certificates based on the CA certificate, which. Rated medium severity (CVSS 4.4). No vendor patch available.

Authentication Bypass Race Condition Puppet Enterprise Puppet Mcollective +1

NVD

CVSS 2.0

4.4

EPSS

0.0%

CVE-2017-2292

EPSS 2% CVSS 9.0

CRITICAL Act Now

RCE Deserialization Puppet +1

NVD

CVE-2014-3251

EPSS 0% CVSS 4.4

MEDIUM This Month

Authentication Bypass Race Condition Puppet Enterprise +3

NVD