Vulnerabilities > Puppet > Puppet Enterprise > 2018.1.0
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2018-08-24 | CVE-2018-11749 | Cleartext Transmission of Sensitive Information vulnerability in Puppet Enterprise When users are configured to use startTLS with RBAC LDAP, at login time, the user's credentials are sent via plaintext to the LDAP server. | 5.0 |
| 2018-06-11 | CVE-2018-6513 | Untrusted Search Path vulnerability in Puppet and Puppet Enterprise Puppet Enterprise 2016.4.x prior to 2016.4.12, Puppet Enterprise 2017.3.x prior to 2017.3.7, Puppet Enterprise 2018.1.x prior to 2018.1.1, Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x prior to 5.5.2, were vulnerable to an attack where an unprivileged user on Windows agents could write custom facts that can escalate privileges on the next puppet run. | 6.5 |
| 2018-06-11 | CVE-2018-6512 | Code Injection vulnerability in Puppet Pe-Razor-Server, Puppet Enterprise and Razor-Server The previous version of Puppet Enterprise 2018.1 is vulnerable to unsafe code execution when upgrading pe-razor-server. | 7.5 |