CVE Daily – CFEngine https://cvedaily.com/pages/tags/cfengine.html CVE Daily – CFEngine en Wed, 03 Jun 2026 21:26:33 +0000 [Medium] CVE-2026-33553 – Northern.tech CFEngine Enterprise 3.24.3 before 3.24.4 and 3.27.0 before 3.27.1 ... https://nvd.nist.gov/vuln/detail/CVE-2026-33553 https://nvd.nist.gov/vuln/detail/CVE-2026-33553 Tue, 02 Jun 2026 20:16:34 +0000 Medium CVE-2026-33553

Northern.tech CFEngine Enterprise 3.24.3 before 3.24.4 and 3.27.0 before 3.27.1 allows XSS.

CVSS: 6.1 · CWE: CWE-79

View on NVD

]]> [High] CVE-2026-24712 – Northern.tech CFEngine Enterprise and Community before 3.21.8, 3.24.3, and 3.27... https://nvd.nist.gov/vuln/detail/CVE-2026-24712 https://nvd.nist.gov/vuln/detail/CVE-2026-24712 Thu, 14 May 2026 15:16:44 +0000 High CVE-2026-24712

Northern.tech CFEngine Enterprise and Community before 3.21.8, 3.24.3, and 3.27.0 allows Command injection.

CVSS: 7.3 · CWE: CWE-77

View on NVD

]]> [Medium] CVE-2026-24711 – Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 has Incorrec... https://nvd.nist.gov/vuln/detail/CVE-2026-24711 https://nvd.nist.gov/vuln/detail/CVE-2026-24711 Thu, 14 May 2026 15:16:44 +0000 Medium CVE-2026-24711

Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 has Incorrect Access Control.

CVSS: 5.3 · CWE: CWE-284

View on NVD

]]> [Medium] CVE-2026-24710 – Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 allows XSS. https://nvd.nist.gov/vuln/detail/CVE-2026-24710 https://nvd.nist.gov/vuln/detail/CVE-2026-24710 Thu, 14 May 2026 15:16:44 +0000 Medium CVE-2026-24710

Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 allows XSS.

CVSS: 6.1 · CWE: CWE-79

View on NVD

]]> [Medium] CVE-2024-55958 – Northern.tech CFEngine Enterprise Mission Portal 3.24.0, 3.21.5, and below allow... https://nvd.nist.gov/vuln/detail/CVE-2024-55958 https://nvd.nist.gov/vuln/detail/CVE-2024-55958 Tue, 21 Jan 2025 21:15:11 +0000 Medium CVE-2024-55958

Northern.tech CFEngine Enterprise Mission Portal 3.24.0, 3.21.5, and below allows XSS. The fixed versions are 3.24.1 and 3.21.6.

CVSS: 4.8 · CWE: CWE-79

View on NVD

]]> [High] CVE-2023-45684 – Northern.tech CFEngine Enterprise before 3.21.3 allows SQL Injection. The fixed ... https://nvd.nist.gov/vuln/detail/CVE-2023-45684 https://nvd.nist.gov/vuln/detail/CVE-2023-45684 Tue, 14 Nov 2023 15:15:07 +0000 High CVE-2023-45684

Northern.tech CFEngine Enterprise before 3.21.3 allows SQL Injection. The fixed versions are 3.18.6 and 3.21.3. The earliest affected version is 3.6.0. The issue is in the Mission Portal login page in the CFEngine hub.

CVSS: 7.5 · CWE: CWE-89

View on NVD

]]> [Medium] CVE-2023-26560 – Northern.tech CFEngine Enterprise before 3.21.1 allows a subset of authenticated... https://nvd.nist.gov/vuln/detail/CVE-2023-26560 https://nvd.nist.gov/vuln/detail/CVE-2023-26560 Wed, 26 Apr 2023 00:15:09 +0000 Medium CVE-2023-26560

Northern.tech CFEngine Enterprise before 3.21.1 allows a subset of authenticated users to leverage the Scheduled Reports feature to read arbitrary files and potentially discover credentials.

CVSS: 6.5 · CWE: CWE-203

View on NVD

]]> [Medium] CVE-2021-44216 – Northern.tech CFEngine Enterprise before 3.15.5 and 3.18.x before 3.18.1 has Ins... https://nvd.nist.gov/vuln/detail/CVE-2021-44216 https://nvd.nist.gov/vuln/detail/CVE-2021-44216 Thu, 10 Mar 2022 17:44:14 +0000 Medium CVE-2021-44216

Northern.tech CFEngine Enterprise before 3.15.5 and 3.18.x before 3.18.1 has Insecure Permissions that may allow unauthorized local users to access the Apache and Mission Portal log files.

CVSS: 5.5 · CWE: CWE-276

View on NVD

]]> [Medium] CVE-2021-44215 – Northern.tech CFEngine Enterprise 3.15.4 before 3.15.5 has Insecure Permissions ... https://nvd.nist.gov/vuln/detail/CVE-2021-44215 https://nvd.nist.gov/vuln/detail/CVE-2021-44215 Thu, 10 Mar 2022 17:44:13 +0000 Medium CVE-2021-44215

Northern.tech CFEngine Enterprise 3.15.4 before 3.15.5 has Insecure Permissions that may allow unauthorized local users to have an unspecified impact.

CVSS: 5.5 · CWE: CWE-276

View on NVD

]]> [Medium] CVE-2021-38379 – The Hub in CFEngine Enterprise 3.6.7 through 3.18.0 has Insecure Permissions tha... https://nvd.nist.gov/vuln/detail/CVE-2021-38379 https://nvd.nist.gov/vuln/detail/CVE-2021-38379 Wed, 27 Oct 2021 15:15:08 +0000 Medium CVE-2021-38379

The Hub in CFEngine Enterprise 3.6.7 through 3.18.0 has Insecure Permissions that allow local Information Disclosure.

CVSS: 5.5 · CWE: CWE-276

View on NVD

]]> [Medium] CVE-2021-36756 – CFEngine Enterprise 3.15.0 through 3.15.4 has Missing SSL Certificate Validation... https://nvd.nist.gov/vuln/detail/CVE-2021-36756 https://nvd.nist.gov/vuln/detail/CVE-2021-36756 Wed, 27 Oct 2021 15:15:07 +0000 Medium CVE-2021-36756

CFEngine Enterprise 3.15.0 through 3.15.4 has Missing SSL Certificate Validation.

CVSS: 6.5 · CWE: CWE-295

View on NVD

]]> [Medium] CVE-2019-19394 – Northern.tech CFEngine Enterprise before 3.10.7, 3.11.x and 3.12.x before 3.12.3... https://nvd.nist.gov/vuln/detail/CVE-2019-19394 https://nvd.nist.gov/vuln/detail/CVE-2019-19394 Thu, 16 Apr 2020 19:15:22 +0000 Medium CVE-2019-19394

Northern.tech CFEngine Enterprise before 3.10.7, 3.11.x and 3.12.x before 3.12.3, 3.13.x, and 3.14.x allows XSS. This is fixed in 3.10.7, 3.12.3, and 3.15.0.

CVSS: 6.1 · CWE: CWE-79

View on NVD

]]> [High] CVE-2019-9929 – Northern.tech CFEngine Enterprise 3.12.1 has Insecure Permissions. https://nvd.nist.gov/vuln/detail/CVE-2019-9929 https://nvd.nist.gov/vuln/detail/CVE-2019-9929 Thu, 06 Jun 2019 17:29:00 +0000 High CVE-2019-9929

Northern.tech CFEngine Enterprise 3.12.1 has Insecure Permissions.

CVSS: 8.8 · CWE: CWE-532

View on NVD

]]> [Low] CVE-2005-2960 – cfengine 1.6.5 and 2.1.16 allows local users to overwrite arbitrary files via a ... https://nvd.nist.gov/vuln/detail/CVE-2005-2960 https://nvd.nist.gov/vuln/detail/CVE-2005-2960 Wed, 05 Oct 2005 19:02:00 +0000 Low CVE-2005-2960

cfengine 1.6.5 and 2.1.16 allows local users to overwrite arbitrary files via a symlink attack on temporary files used by vicf.in, a different vulnerability than CVE-2005-3137.

CVSS: 2.1 · CWE: N/A

View on NVD

]]> [Low] CVE-2005-3137 – The (1) cfmailfilter and (2) cfcron.in files for cfengine 1.6.5 allow local user... https://nvd.nist.gov/vuln/detail/CVE-2005-3137 https://nvd.nist.gov/vuln/detail/CVE-2005-3137 Wed, 05 Oct 2005 19:02:00 +0000 Low CVE-2005-3137

The (1) cfmailfilter and (2) cfcron.in files for cfengine 1.6.5 allow local users to overwrite arbitrary files via a symlink attack on temporary files, a different vulnerability than CVE-2005-2960.

CVSS: 2.1 · CWE: N/A

View on NVD

]]> [Critical] CVE-2004-1701 – Heap-based buffer overflow in the AuthenticationDialogue function in cfservd for... https://nvd.nist.gov/vuln/detail/CVE-2004-1701 https://nvd.nist.gov/vuln/detail/CVE-2004-1701 Mon, 09 Aug 2004 04:00:00 +0000 Critical CVE-2004-1701

Heap-based buffer overflow in the AuthenticationDialogue function in cfservd for Cfengine 2.0.0 to 2.1.7p1 allows remote attackers to execute arbitrary code via a long SAUTH command during RSA authentication.

CVSS: 10.0 · CWE: N/A

View on NVD

]]> [Medium] CVE-2004-1702 – The AuthenticationDialogue function in cfservd for Cfengine 2.0.0 to 2.1.7p1 doe... https://nvd.nist.gov/vuln/detail/CVE-2004-1702 https://nvd.nist.gov/vuln/detail/CVE-2004-1702 Mon, 09 Aug 2004 04:00:00 +0000 Medium CVE-2004-1702

The AuthenticationDialogue function in cfservd for Cfengine 2.0.0 to 2.1.7p1 does not properly check the return value of the ReceiveTransaction function, which leads to a failed malloc call and triggers to a null dereference, which allows remote attackers to cause a denial of service (crash).

CVSS: 5.0 · CWE: N/A

View on NVD

]]> [High] CVE-2003-0849 – Buffer overflow in net.c for cfengine 2.x before 2.0.8 allows remote attackers t... https://nvd.nist.gov/vuln/detail/CVE-2003-0849 https://nvd.nist.gov/vuln/detail/CVE-2003-0849 Mon, 17 Nov 2003 05:00:00 +0000 High CVE-2003-0849

Buffer overflow in net.c for cfengine 2.x before 2.0.8 allows remote attackers to execute arbitrary code via certain packets with modified length values, which is trusted by the ReceiveTransaction function when using a buffer provided by the BusyWithConnection function.

CVSS: 7.5 · CWE: N/A

View on NVD

]]> [Critical] CVE-2000-0947 – Format string vulnerability in cfd daemon in GNU CFEngine before 1.6.0a11 allows... https://nvd.nist.gov/vuln/detail/CVE-2000-0947 https://nvd.nist.gov/vuln/detail/CVE-2000-0947 Tue, 19 Dec 2000 05:00:00 +0000 Critical CVE-2000-0947

Format string vulnerability in cfd daemon in GNU CFEngine before 1.6.0a11 allows attackers to execute arbitrary commands via format characters in the CAUTH command.

CVSS: 10.0 · CWE: N/A

View on NVD

]]> [Low] CVE-1999-0374 – Debian GNU/Linux cfengine package is susceptible to a symlink attack. https://nvd.nist.gov/vuln/detail/CVE-1999-0374 https://nvd.nist.gov/vuln/detail/CVE-1999-0374 Tue, 16 Feb 1999 05:00:00 +0000 Low CVE-1999-0374

Debian GNU/Linux cfengine package is susceptible to a symlink attack.

CVSS: 2.1 · CWE: N/A

View on NVD

]]>