Skip to contentCloud Foundry vulnerabilities
Newest
- cloud foundry uaa release (oss), pivotal software cloud foundry uaa-release +1 moreUAA defaults email address to an insecure domainCVE-2019-37878.3 High
- cloud foundry boshBosh Deployment logs leak sensitive informationCVE-2019-112716.0 Medium
- cloud foundry cf-deployment, credhub, uaa release (oss) +2 more +4 moreJava Projects using HTTP to fetch dependenciesCVE-2019-38018.7 High
- cloudfoundry uaa release, cloud foundry uaa release (oss), pivotal application service +2 moreUAA redirect-uri allows wildcard in the subdomainCVE-2019-37888.7 High
- cloudfoundry routing release, cloud foundry cf routing +1 moreGorouter allows space developer to hijack route services hosted outside the platformCVE-2019-37898.8 High
- cloud foundry bosh backup and restoreBBR could run arbitrary scripts on deployment VMsCVE-2019-37867.7 High
- cloud foundry capi-releaseEscalation of Privileges in Cloud ControllerCVE-2019-37986.0 Medium
- cloud foundry capi, cloudfoundry capi-release +1 moreCloud Controller provides signed URL with write authorization to read only userCVE-2019-37856.5 Medium
- cloudfoundry container runtime, cloud foundry container runtime (cfcr) +1 moreCloud Foundry Container Runtime Leaks IAAS CredentialsCVE-2019-37809.1 Critical
- cloudfoundry container runtime, cloud foundry container runtime (cfcr) +1 moreCloud Foundry Container Runtime allows a user to bypass security policy when talking to ETCDCVE-2019-37798.8 High
- cloud foundry stratosCloud Foundry Stratos contains a Session Collision VulnerabilityCVE-2019-37848.2 High
- cloud foundry stratosCloud Foundry Stratos Deploys With Public Default Session Store SecretCVE-2019-37838.7 High
- cloud foundry cf cli, cloudfoundry command line interface +1 moreCF CLI does not sanitize user's password in verbose/trace/debugCVE-2019-3781Fix available8.2 High
- cloud foundry uaa release (oss), cloudfoundry uaa release +1 moreUAA allows users to modify their own email addressCVE-2019-37757.1 High
- cloud foundry credhub cliCredHub CLI writes environment variable credentials to diskCVE-2019-37826.3 Medium
- cloud foundry uaa release, pivotal software cloud foundry uaa-release +1 moreUAA can issue tokens across identity providers if users with matching usernames existCVE-2018-157544.2 Medium
- cloud foundry bits service, bits service release +1 moreTiming attack allows extraction of signing key in Bits ServiceCVE-2018-158008.1 High
- cloud foundry nfs volume release, pivotal software cloud foundry nfs volume +1 moreNFS Volume release errand leaks cf admin credentials in logsCVE-2018-157978.4 High
- cloud foundry uaa, uaa release, pivotal software cloud foundry uaa +1 more +3 moreUAA Privilege EscalationCVE-2018-15761Fix available9.9 Critical
- pivotal software bits service, cloud foundry bits-service-release +1 moreSigning Key Extraction in Bits Service ReleaseCVE-2018-157968.1 High
- cloud foundry cf networking release, cf-networking +1 moreCF networking internal policy server SQL injectionCVE-2018-157556.6 Medium
- pivotal software cloud foundry log cache, cloud foundry log-cache-release +1 moreLog Cache logs UAA client secret on startupCVE-2018-12649.1 Critical
- cloud foundry boshBosh accepts refresh tokens in place of an access tokenCVE-2018-110838.4 High
- cloud foundry uaa, uaa release, pivotal software cloudfoundry uaa +1 more +3 moreCloud Foundry UAA MFA does not prevent brute force of MFA codeCVE-2018-110826.6 Medium
- cloud foundry garden-runcGarden-runC prevents deletion of some app environmentsCVE-2018-110846.8 Medium
- cloud foundry container runtime, pivotal cloud foundry container runtime +1 moreCloud Foundry Container Runtime (kubo-release), versions prior to 0.14.0, may leak UAA and...CVE-2018-12238.8 High
- cloud foundry uaa, pivotal software cloud foundry uaa +1 moreCloud Foundry UAA accepts refresh token as access token on admin endpointsCVE-2018-11047Fix available7.5 High
- cloud foundry foundry, cloudfoundry cloud foundry, java buildpack +1 more +3 moreApplications deployed to Cloud Foundry, versions v166 through v227, may be vulnerable to a remote...CVE-2016-07085.9 Medium
- cloud foundry uaa, pivotal software cloud foundry uaa, cloud foundry uaa-release +2 moreCloud Foundry UAA open redirectCVE-2018-11041Fix available6.1 Medium
- [unknown] routing, redhat openshift container platform +1 morerouting before version 3.10 is vulnerable to an improper input validation of the Openshift...CVE-2018-10706.5 Medium
- cloud foundry loggregatorCloud Foundry Loggregator, versions 89.x prior to 89.5 or 96.x prior to 96.1 or 99.x prior to 99...CVE-2018-12696.5 Medium
- cloud foundry loggregatorCloud Foundry Loggregator, versions 89.x prior to 89.5 or 96.x prior to 96.1 or 99.x prior to 99...CVE-2018-12686.8 Medium
- cloud foundry diego, pivotal software cloud foundry diego, cloudfoundry cf-deployment +2 moreCloud Foundry Diego, release versions prior to 2.8.0, does not properly sanitize file paths in...CVE-2018-12657.2 High
- cloudfoundry routing-release, cloud foundry router, cloudfoundry cf-deployment +2 moreCloud Foundry routing-release, versions prior to 0.175.0, lacks sanitization for user-provided X-Forwarded-Proto headers. A remote user can set the X-Forwarded-Proto header in a request to potentially…CVE-2018-11935.3 Medium
- cloud foundry windows2012r2 stemcell, pivotal software windows stemcells +1 moreWindows 2012R2 stemcells, versions prior to 1200.17, contain an information exposure...CVE-2018-12766.5 Medium
- cloud foundry cloudfoundry uaa, cloudfoundry cf-deployment, pivotal software cloud foundry uaa +1 more +3 moreUAA privilege escalation across identity zonesCVE-2018-1262Fix available7.2 High
- cloud foundry garden-runc, cloudfoundry cf-deployment +1 moreCloud Foundry Garden-runC, versions prior to 1.13.0, does not correctly enforce disc quotas for...CVE-2018-12776.5 Medium
- cloud foundry controller, cloudfoundry capi-release, cf-release +1 more +3 moreCloud Foundry Cloud Controller, capi-release versions prior to 1.0.0 and cf-release versions...CVE-2016-21695.3 Medium
- cloud foundry garden-runc, cloudfoundry cf-deployment, garden-runc-release +2 moreCloud Foundry Garden-runC, versions prior to 1.11.0, contains an information exposure...CVE-2018-11918.8 High
- cloud foundry uaa, cloudfoundry cf-release, pivotal software cloud foundry uaa +1 more +3 moreCloud Foundry UAA password reset vulnerabilityCVE-2017-4991Fix available7.2 High
- cloud foundry uaa, cloudfoundry cf-release, pivotal software cloud foundry uaa +1 more +3 moreBlind SQL Injection with privileged Cloud Foundry UAA endpointsCVE-2017-4974Fix available6.5 Medium
- cloud foundry uaa, pivotal software cloud foundry uaa, cloudfoundry cloud foundry uaa bosh +1 more +3 moreCloud Foundry UAA Privilege EscalationCVE-2017-4973Fix available8.8 High
- cloud foundry uaa, cloudfoundry cf-release, cloud foundry uaa bosh +1 more +3 moreAn issue was discovered in Cloud Foundry Foundation cf-release versions prior to v257; UAA...CVE-2017-49727.5 High