Spring by Pivotal

Records146All Threatist records

Exploited (KEV)1In CISA KEV

CVSS critical30CVSS 9.0–10.0

CVSS high64CVSS 7.0–8.9

Exploited now

Spring by Pivotal records in CISA KEV

TI-2018-01178 VMware Tanzu Spring Data Commons Property Binder Vulnerability CRITICAL 100KEV 2022-03-25

Components

Products in the NVD configurations · select one to filter the records

Cloud Foundry Uaa 32 records MEDIUM Cloud Foundry Elastic Runtime 28 records MEDIUM Rabbitmq 11 records MEDIUM Cloud Foundry 10 records MEDIUM Operations Manager 10 records MEDIUM Spring Framework 10 records HIGH Cloud Foundry Uaa-release 8 records MEDIUM Concourse 7 records MEDIUM

Records

10 records in Cloud Foundry · all components

TI-2016-04326 CVE-2016-5006 · GHSA-6q7m-3j88-7g48

The Cloud Controller in Cloud Foundry before 239 logs user-provided service objects at…

MEDIUM 44

The Cloud Controller in Cloud Foundry before 239 logs user-provided service objects at creation, which allows attackers to obtain sensitive user credential information via unspecified vectors.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01141 Published 2017-05-02 No fix listed CWE-200

TI-2016-05699 CVE-2016-6651 · GHSA-42fx-hqwh-j72r

The UAA /oauth/token endpoint in Pivotal Cloud Foundry (PCF) before 243; UAA 2.x before…

MEDIUM 42

The UAA /oauth/token endpoint in Pivotal Cloud Foundry (PCF) before 243; UAA 2.x before 2.7.4.8, 3.x before 3.3.0.6, and 3.4.x before 3.4.5; UAA BOSH before 11.7 and 12.x before 12.6; Elastic Runtime before 1.6.40, 1.7.x…

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01748 Published 2016-09-30 No fix listed CWE-264

TI-2016-05687 CVE-2016-6637 · GHSA-4m8c-h7fr-gq5c

Multiple cross-site request forgery (CSRF) vulnerabilities in Pivotal Cloud Foundry (PCF)…

MEDIUM 42

Multiple cross-site request forgery (CSRF) vulnerabilities in Pivotal Cloud Foundry (PCF) before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x before 3.4.4; UAA BOSH before 11.5 and 12.x before 12.5; Elastic…

CVSS 3.0CRITICAL 9.6 Network No auth User interaction EPSS 0.00726 Published 2016-09-30 Fixed in 2.7.4.7, 3.3.0.5 +2 CWE-352

TI-2016-03841 CVE-2016-4468 · GHSA-6q84-cfgm-7vcv

SQL injection vulnerability in Pivotal Cloud Foundry (PCF) before 238; UAA 2.x before…

MEDIUM 42

SQL injection vulnerability in Pivotal Cloud Foundry (PCF) before 238; UAA 2.x before 2.7.4.4, 3.x before 3.3.0.2, and 3.4.x before 3.4.1; UAA BOSH before 11.2 and 12.x before 12.2; Elastic Runtime before 1.6.29 and 1.7.…

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.02139 Published 2017-04-11 No fix listed CWE-89

TI-2016-05706 CVE-2016-6659 · GHSA-8pj8-jjrc-8g8h

Improper authentication in Cloud Foundry v247 and earlier and UAA v3.9.2 & earlier and…

LOW 38

Cloud Foundry before 248; UAA 2.x before 2.7.4.12, 3.x before 3.6.5, and 3.7.x through 3.9.x before 3.9.3; and UAA bosh release (aka uaa-release) before 13.9 for UAA 3.6.5 and before 24 for UAA 3.9.3 allow attackers to g…

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.01144 Published 2016-12-23 No fix listed CWE-287

TI-2016-02583 CVE-2016-3084 · GHSA-fm5c-2rwc-887w

Access control flaw in Pivotal Cloud Foundry

LOW 38

The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA release v10 and earlier versions and Pivotal Elastic Runtime vers…

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.0119 Published 2017-05-25 Fixed in 3.3.0.1 CWE-264

TI-2017-03086 CVE-2017-4960 · GHSA-hxgw-7539-pv7r

An issue was discovered in Cloud Foundry release v247 through v252, UAA stand-alone…

LOW 36

An issue was discovered in Cloud Foundry release v247 through v252, UAA stand-alone release v3.9.0 through v3.11.0, and UAA Bosh Release v21 through v26.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01581 Published 2017-03-10 Fixed in 3.12.0, 3.9.8

TI-2016-04335 CVE-2016-5016 · GHSA-rc2r-w8jv-vggp

Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server)…

LOW 28

Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server) 3.4.1 and earlier, UAA release 12.2 and earlier, PCF (aka Pivotal Cloud Foundry) Elastic Runtime 1.6.x before 1.6.35, and PCF Elasti…

CVSS 3.0MEDIUM 5.9 Network No auth No interaction EPSS 0.01032 Published 2017-04-24 Fixed in 3.3.0.3, 3.4.2 CWE-295

TI-2016-00699 CVE-2016-0781 · GHSA-cfh6-j4mw-8cx7

Cross-site scripting in Pivotal Cloud Foundry

LOW 28

The UAA OAuth approval pages in Cloud Foundry v208 to v231, Login-server v1.6 to v1.14, UAA v2.0.0 to v2.7.4.1, UAA v3.0.0 to v3.2.0, UAA-Release v2 to v7 and Pivotal Elastic Runtime 1.6.x versions prior to 1.6.20 are vu…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00656 Published 2017-05-25 No fix listed CWE-79

TI-2016-05686 CVE-2016-6636 · GHSA-ffj6-5gww-48qc

The OAuth authorization implementation in Pivotal Cloud Foundry (PCF) before 242; UAA 2.x…

LOW 27

The OAuth authorization implementation in Pivotal Cloud Foundry (PCF) before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x before 3.4.4; UAA BOSH before 11.5 and 12.x before 12.5; Elastic Runtime before 1.6.…

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.01385 Published 2016-09-30 No fix listed CWE-601

Open these records in search →