Pivotal Software

Cloud Foundry

10 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.1

CVE-2016-0781

  • EPSS 0.27%
  • Published 25.05.2017 17:29:00
  • Last modified 20.04.2025 01:37:25

The UAA OAuth approval pages in Cloud Foundry v208 to v231, Login-server v1.6 to v1.14, UAA v2.0.0 to v2.7.4.1, UAA v3.0.0 to v3.2.0, UAA-Release v2 to v7 and Pivotal Elastic Runtime 1.6.x versions prior to 1.6.20 are vulnerable to an XSS attack by s...

8.1

CVE-2016-3084

  • EPSS 0.34%
  • Published 25.05.2017 17:29:00
  • Last modified 20.04.2025 01:37:25

The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA release v10 and earlier versions and Pivotal Elastic Runtime versions prior to 1.7.2 is vulnera...

9.8

CVE-2016-5006

  • EPSS 0.33%
  • Published 02.05.2017 14:59:00
  • Last modified 20.04.2025 01:37:25

The Cloud Controller in Cloud Foundry before 239 logs user-provided service objects at creation, which allows attackers to obtain sensitive user credential information via unspecified vectors.

5.9

CVE-2016-5016

  • EPSS 0.28%
  • Published 24.04.2017 19:59:00
  • Last modified 20.04.2025 01:37:25

Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server) 3.4.1 and earlier, UAA release 12.2 and earlier, PCF (aka Pivotal Cloud Foundry) Elastic Runtime 1.6.x before 1.6.35, and PCF Elastic Runtime 1.7.x before 1.7.13 ...

8.8

CVE-2016-4468

  • EPSS 1.33%
  • Published 11.04.2017 15:59:00
  • Last modified 20.04.2025 01:37:25

SQL injection vulnerability in Pivotal Cloud Foundry (PCF) before 238; UAA 2.x before 2.7.4.4, 3.x before 3.3.0.2, and 3.4.x before 3.4.1; UAA BOSH before 11.2 and 12.x before 12.2; Elastic Runtime before 1.6.29 and 1.7.x before 1.7.7; and Ops Manage...

7.5

CVE-2017-4960

  • EPSS 0.45%
  • Published 10.03.2017 01:59:00
  • Last modified 20.04.2025 01:37:25

An issue was discovered in Cloud Foundry release v247 through v252, UAA stand-alone release v3.9.0 through v3.11.0, and UAA Bosh Release v21 through v26. There is a potential to subject the UAA OAuth clients to a denial of service attack.

8.1

CVE-2016-6659

  • EPSS 0.32%
  • Published 23.12.2016 05:59:00
  • Last modified 12.04.2025 10:46:40

Cloud Foundry before 248; UAA 2.x before 2.7.4.12, 3.x before 3.6.5, and 3.7.x through 3.9.x before 3.9.3; and UAA bosh release (aka uaa-release) before 13.9 for UAA 3.6.5 and before 24 for UAA 3.9.3 allow attackers to gain privileges by accessing UA...

8.8

CVE-2016-6651

  • EPSS 0.58%
  • Published 30.09.2016 00:59:04
  • Last modified 12.04.2025 10:46:40

The UAA /oauth/token endpoint in Pivotal Cloud Foundry (PCF) before 243; UAA 2.x before 2.7.4.8, 3.x before 3.3.0.6, and 3.4.x before 3.4.5; UAA BOSH before 11.7 and 12.x before 12.6; Elastic Runtime before 1.6.40, 1.7.x before 1.7.21, and 1.8.x befo...

9.6

CVE-2016-6637

  • EPSS 0.12%
  • Published 30.09.2016 00:59:01
  • Last modified 12.04.2025 10:46:40

Multiple cross-site request forgery (CSRF) vulnerabilities in Pivotal Cloud Foundry (PCF) before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x before 3.4.4; UAA BOSH before 11.5 and 12.x before 12.5; Elastic Runtime before 1.6.40, 1.7.x ...

5.3

CVE-2016-6636

  • EPSS 0.24%
  • Published 30.09.2016 00:59:00
  • Last modified 12.04.2025 10:46:40

The OAuth authorization implementation in Pivotal Cloud Foundry (PCF) before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x before 3.4.4; UAA BOSH before 11.5 and 12.x before 12.5; Elastic Runtime before 1.6.40, 1.7.x before 1.7.21, and 1...