Puppet Marionette Collective — known CVE vulnerabilities

Every CVE whose affected-product data names Puppet Marionette Collective, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (3)

• CVE-2014-0175 — CVSS 9.8 (critical): mcollective has a default password set at install
• CVE-2016-2788 — CVSS 9.8 (critical): MCollective 2.7.0 and 2.8.x before 2.8.9, as used in Puppet Enterprise, allows remote attackers to execute arbitrary code via vectors…
• CVE-2014-3248 — CVSS 6.2 (medium): Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x…