Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

15 records

Vendor: CloudFoundry Foundation Component: Cloud Foundry Uaa Bosh Clear all filters
TI-2017-05625 CVE-2017-8032 · GHSA-9frw-wmvq-5rrc

Improper privilege management in Cloud Foundry

Priority LOW 31

In Cloud Foundry cf-release versions prior to v264; UAA release all versions of UAA v2.x.x, 3.6.x versions prior to v3.6.13, 3.9.x versions prior to v3.9.15, 3.20.x versions prior to v3.20.0, and other versions prior to…

CVSS 3.0MEDIUM 6.6 Network High privileges No interaction EPSS 0.00879 Published 2017-07-10 Fixed in 3.6.13, 3.9.15 +2 CWE-269
TI-2017-03117 CVE-2017-4994 · GHSA-75xv-v35m-f8rh

Improper input validation in Cloud Foundry

Priority LOW 35

An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v263; UAA release 2.x versions prior to v2.7.4.18, 3.6.x versions prior to v3.6.12, 3.9.x versions prior to v3.9.14, and other versions pri…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01105 Published 2017-06-13 No fix listed CWE-20
TI-2017-03116 CVE-2017-4992 · GHSA-jcmh-x32v-7mgf

Improper privilege management in Cloud Foundry

Priority MEDIUM 44

An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v261; UAA release 2.x versions prior to v2.7.4.17, 3.6.x versions prior to v3.6.11, 3.9.x versions prior to v3.9.13, and other versions pri…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01167 Published 2017-06-13 Fixed in 2.7.4.17, 3.6.11 +2 CWE-269
TI-2017-03115 CVE-2017-4991 · GHSA-cgrg-x34r-78f3

Improper privilege management in Cloud Foundry UAA

Priority LOW 33

An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v260; UAA release 2.x versions prior to v2.7.4.16, 3.6.x versions prior to v3.6.10, 3.9.x versions prior to v3.9.12, and other versions pri…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00936 Published 2017-06-13 Fixed in 2.7.4.16, 3.6.10 +2 CWE-269
TI-2017-03098 CVE-2017-4974 · GHSA-cw9c-v3v2-99hm

SQL injection in Cloud Foundry UAA

Priority LOW 31

An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v258; UAA release 2.x versions prior to v2.7.4.15, 3.6.x versions prior to v3.6.9, 3.9.x versions prior to v3.9.11, and other versions prio…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00974 Published 2017-06-13 Fixed in 2.7.4.15, 3.6.9 +2 CWE-89
TI-2017-03097 CVE-2017-4973 · GHSA-pgjc-gc7g-p2c6

Improper privilege management in Cloud Foundry UAA

Priority MEDIUM 40

An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v257; UAA release 2.x versions prior to v2.7.4.14, 3.6.x versions prior to v3.6.8, 3.9.x versions prior to v3.9.10, and other versions prio…

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01068 Published 2017-06-13 Fixed in 2.7.4.14, 3.6.8 +2 CWE-269
TI-2017-03096 CVE-2017-4972 · GHSA-5w93-xgv6-rpgw

SQL injection in Cloud Foundry UAA

Priority LOW 35

An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v257; UAA release 2.x versions prior to v2.7.4.14, 3.6.x versions prior to v3.6.8, 3.9.x versions prior to v3.9.10, and other versions prio…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01085 Published 2017-06-13 No fix listed CWE-89
TI-2016-02583 CVE-2016-3084 · GHSA-fm5c-2rwc-887w

Access control flaw in Pivotal Cloud Foundry

Priority LOW 38

The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA release v10 and earlier versions and Pivotal Elastic Runtime vers…

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.0119 Published 2017-05-25 Fixed in 3.3.0.1 CWE-264
TI-2016-00699 CVE-2016-0781 · GHSA-cfh6-j4mw-8cx7

Cross-site scripting in Pivotal Cloud Foundry

Priority LOW 28

The UAA OAuth approval pages in Cloud Foundry v208 to v231, Login-server v1.6 to v1.14, UAA v2.0.0 to v2.7.4.1, UAA v3.0.0 to v3.2.0, UAA-Release v2 to v7 and Pivotal Elastic Runtime 1.6.x versions prior to 1.6.20 are vu…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00656 Published 2017-05-25 No fix listed CWE-79
TI-2016-03841 CVE-2016-4468 · GHSA-6q84-cfgm-7vcv

SQL injection vulnerability in Pivotal Cloud Foundry (PCF) before 238; UAA 2.x before…

Priority MEDIUM 42

SQL injection vulnerability in Pivotal Cloud Foundry (PCF) before 238; UAA 2.x before 2.7.4.4, 3.x before 3.3.0.2, and 3.4.x before 3.4.1; UAA BOSH before 11.2 and 12.x before 12.2; Elastic Runtime before 1.6.29 and 1.7.…

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.02139 Published 2017-04-11 No fix listed CWE-89
TI-2016-05699 CVE-2016-6651 · GHSA-42fx-hqwh-j72r

The UAA /oauth/token endpoint in Pivotal Cloud Foundry (PCF) before 243; UAA 2.x before…

Priority MEDIUM 42

The UAA /oauth/token endpoint in Pivotal Cloud Foundry (PCF) before 243; UAA 2.x before 2.7.4.8, 3.x before 3.3.0.6, and 3.4.x before 3.4.5; UAA BOSH before 11.7 and 12.x before 12.6; Elastic Runtime before 1.6.40, 1.7.x…

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01748 Published 2016-09-30 No fix listed CWE-264
TI-2016-05687 CVE-2016-6637 · GHSA-4m8c-h7fr-gq5c

Multiple cross-site request forgery (CSRF) vulnerabilities in Pivotal Cloud Foundry (PCF)…

Priority MEDIUM 42

Multiple cross-site request forgery (CSRF) vulnerabilities in Pivotal Cloud Foundry (PCF) before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x before 3.4.4; UAA BOSH before 11.5 and 12.x before 12.5; Elastic…

CVSS 3.0CRITICAL 9.6 Network No auth User interaction EPSS 0.00726 Published 2016-09-30 Fixed in 2.7.4.7, 3.3.0.5 +2 CWE-352
TI-2016-05686 CVE-2016-6636 · GHSA-ffj6-5gww-48qc

The OAuth authorization implementation in Pivotal Cloud Foundry (PCF) before 242; UAA 2.x…

Priority LOW 27

The OAuth authorization implementation in Pivotal Cloud Foundry (PCF) before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x before 3.4.4; UAA BOSH before 11.5 and 12.x before 12.5; Elastic Runtime before 1.6.…

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.01385 Published 2016-09-30 No fix listed CWE-601