Pivotal Software vulnerabilities

Products

• Cloud Foundry Uaa 32
• Cloud Foundry Elastic Runtime 28
• Rabbitmq 11
• Spring Framework 11
• Cloud Foundry 10
• Operations Manager 10
• Cloud Foundry Uaa-release 8
• Concourse 7
• Application Service 7
• Cloud Foundry Ops Manager 5
• Spring Security 5
• Application Service 4
• Spring Data Rest 4
• Spring Security Oauth 4
• Cloud Foundry Cf 3
• Cloud Foundry Cf-deployment 2
• Cloud Foundry Cf-release 2
• Cloudfoundry Uaa Release 2
• Gemfire For Pivotal Cloud Foundry 2
• Login-server 2
• Container Service 2
• Spring Advanced Message Queuing Protocol 2
• Spring Batch Admin 2
• Windows Stemcells 2

Newest

• pivotal software spring security, spring security +1 more Erroneous authentication pass in Spring Security CVE-2024-22257 Fix available 8.2 HighMarch 18, 2024
• pivotal software spring framework, spring framework, netapp active iq unified manager +2 more CVE-2024-22243: Spring Framework URL Parsing with Host Validation CVE-2024-22243 Public exploitFix available 8.1 HighFebruary 23, 2024
• pivotal software concourse Team scope authorization bypass when Post/Put request with :team_name in body, allows HTTP parameter pollution CVE-2022-31683 Fix available 5.4 MediumOctober 19, 2022
• pivotal software spring security, spring security, oracle communications element manager +5 more +7 more Privilege escalation in spring security CVE-2021-22112 Fix available 8.8 HighFebruary 23, 2021
• pivotal software rabbitmq, broadcom rabbitmq server +1 more RabbitMQ arbitrary code execution using local binary planting CVE-2020-5419 Fix available 6.7 MediumAugust 31, 2020
• pivotal software concourse Concourse's GitLab auth allows impersonation CVE-2020-5415 Fix available 10.0 CriticalAugust 12, 2020
• pivotal software spring security, spring security +1 more Dictionary attack with Spring Security queryable text encryptor CVE-2020-5408 Fix available 6.5 MediumMay 14, 2020
• pivotal concourse Concourse Open Redirect in the /sky/login endpoint CVE-2020-5409 Fix available 7.6 HighMay 13, 2020
• pivotal software spring security, spring security +1 more Signature Wrapping Vulnerability with spring-security-saml2-service-provider CVE-2020-5407 Fix available 8.8 HighMay 13, 2020
• cloud foundry credhub, pivotal software cloud foundry cf-deployment +1 more CredHub does not properly enable TLS for MySQL database connections CVE-2020-5399 7.6 HighFebruary 12, 2020
• pivotal ops manager, pivotal software operations manager +1 more Pivotal Ops Manager logs query parameters in tomcat access file CVE-2019-11292 8.8 HighJanuary 8, 2020
• pivotal rabbitmq, rabbitmq for pivotal platform, broadcom rabbitmq server +3 more +5 more RabbitMQ Web Management Plugin DoS via heap overflow CVE-2019-11287 Public exploitFix available 4.5 MediumNovember 22, 2019
• cloud foundry smb volume, pivotal software cloud foundry smb volume, cloud foundry cf deployment +1 more +3 more Password leak in smbdriver logs CVE-2019-11283 8.8 HighOctober 23, 2019
• pivotal software cloud foundry uaa, cloud foundry cf deployment, uaa release +1 more +3 more UAA is vulnerable to a Blind SCIM injection leading to information disclosure CVE-2019-11282 4.3 MediumOctober 23, 2019
• pivotal rabbitmq, rabbitmq for pcf, debian linux +3 more +5 more RabbitMQ XSS attack CVE-2019-11281 Fix available 2.4 LowOctober 16, 2019
• pivotal apps manager, pivotal software application service +1 more CSV Injection in usage report downloaded from Pivotal Application Manager CVE-2019-11275 3.5 LowOctober 1, 2019
• pivotal software application service, pivotal application service (pas) +1 more Privilege escalation through the invitations service CVE-2019-11280 8.8 HighSeptember 20, 2019
• pivotal software application service, pivotal application service (pas) +1 more Apps Manager sends tokens to Spring apps via HTTP CVE-2019-11276 5.4 MediumAugust 19, 2019
• pivotal software cloud foundry uaa, cloud foundry uaa release (oss), pivotal software application service +1 more +3 more UAA clients.write vulnerability CVE-2019-11270 7.3 HighAugust 5, 2019
• pivotal software container service, pivotal container service (pks) +1 more PKS Telemetry logs credentials CVE-2019-11273 2.2 LowJuly 23, 2019
• pivotal software cloud foundry uaa, cloud foundry uaa release (oss) +1 more UAA - Login app subject to clickjacking attack CVE-2019-3794 6.5 MediumJuly 18, 2019
• cloud foundry uaa release (oss), pivotal software cloud foundry uaa-release +1 more UAA SQL Identity Zone Vulnerability CVE-2019-11268 6.5 MediumJuly 11, 2019
• cloud foundry uaa release (oss), pivotal software cloud foundry uaa-release +1 more UAA defaults email address to an insecure domain CVE-2019-3787 8.3 HighJune 19, 2019
• pivotal software spring security oauth, spring security oauth, oracle banking corporate lending +2 more Open Redirector in spring-security-oauth2 CVE-2019-11269 Public exploitFix available 4.2 MediumJune 12, 2019
• pivotal ops manager, pivotal software operations manager +1 more Ops Manager uaa client issues tokens after refresh token expiration CVE-2019-3790 6.1 MediumJune 6, 2019
• spring data jpa, pivotal software spring data java persistance api +1 more Additional information exposure with Spring Data JPA example matcher CVE-2019-3802 Fix available 3.5 LowJune 3, 2019
• pivotal software spring data java persistence api, spring boot +1 more Additional information exposure with Spring Data JPA derived queries CVE-2019-3797 Fix available 3.5 LowMay 6, 2019
• pivotal apps manager, pivotal software application service +1 more Invitations Service supports HTTP connections CVE-2019-3793 8.1 HighApril 24, 2019
• pivotal concourse Concourse 5.0.0 SQL Injection vulnerability CVE-2019-3792 Fix available 6.8 MediumApril 1, 2019
• pivotal software spring security oauth, spring security oauth, oracle banking corporate lending +2 more Open Redirect in spring-security-oauth2 CVE-2019-3778 Public exploitFix available EPSS 16.6% 6.5 MediumMarch 7, 2019
• pivotal apps manager, application service +1 more Apps Manager unverified SSL certs in Cloud Controller proxy CVE-2019-3777 8.0 HighMarch 7, 2019
• pivotal software operations manager, pivotal ops manager +1 more Reflected XSS in Pivotal Operations Manager CVE-2019-3776 7.2 HighMarch 7, 2019
• pivotal concourse Concourse includes token in CLI authentication callback CVE-2019-3803 4.5 MediumJanuary 12, 2019
• pivotal concourse Pivotal Concourse allows malicious redirect urls on login CVE-2018-15798 Fix available 7.6 HighDecember 19, 2018
• cloud foundry uaa release, pivotal software cloud foundry uaa-release +1 more UAA can issue tokens across identity providers if users with matching usernames exist CVE-2018-15754 4.2 MediumDecember 13, 2018
• pivotal rabbitmq for pcf, pivotal software rabbitmq +1 more RabbitMQ cluster compromise due to deterministically generated cookie CVE-2018-1279 Fix available 8.5 HighDecember 10, 2018
• cloud foundry nfs volume release, pivotal software cloud foundry nfs volume +1 more NFS Volume release errand leaks cf admin credentials in logs CVE-2018-15797 8.4 HighDecember 5, 2018
• cloud foundry uaa, uaa release, pivotal software cloud foundry uaa +1 more +3 more UAA Privilege Escalation CVE-2018-15761 Fix available 9.9 CriticalNovember 19, 2018
• pivotal on demand services sdk, pivotal software broker api +1 more On Demand Services SDK Timing Attack Vulnerability CVE-2018-15759 9.1 CriticalNovember 19, 2018
• pivotal cloud foundry credhub service broker CredHub Service Broker uses guessable client secret CVE-2018-15795 Fix available 8.1 HighNovember 13, 2018
• pivotal software bits service, cloud foundry bits-service-release +1 more Signing Key Extraction in Bits Service Release CVE-2018-15796 8.1 HighNovember 9, 2018
• pivotal cloud foundry operations manager Pivotal Operations Manager gives all users heightened privileges CVE-2018-15762 9.0 CriticalNovember 2, 2018
• pivotal spring security oauth, spring security oauth +1 more Privilege Escalation in spring-security-oauth2 CVE-2018-15758 Fix available 9.6 CriticalOctober 18, 2018
• pivotal container service PKS leaks IaaS Credentials to Application Logs CVE-2018-15763 9.0 CriticalOctober 5, 2018
• pivotal software cloud foundry log cache, cloud foundry log-cache-release +1 more Log Cache logs UAA client secret on startup CVE-2018-1264 9.1 CriticalOctober 5, 2018
• cloud foundry uaa, uaa release, pivotal software cloudfoundry uaa +1 more +3 more Cloud Foundry UAA MFA does not prevent brute force of MFA code CVE-2018-11082 6.6 MediumOctober 5, 2018
• pivotal software operations manager, pivotal pivotal-ops-manager +1 more Pivotal Operations Manager UAA config - temp Ram Disk CVE-2018-11081 7.9 HighOctober 5, 2018
• pivotal cloud cache Pivotal Cloud Cache, versions prior to 1.3.1, prints a superuser password in plain text during... CVE-2018-1198 8.8 HighSeptember 17, 2018
• pivotal application service Pivotal Applications Manager in Pivotal Application Service, versions 2.0 prior to 2.0.21 and 2.1... CVE-2018-11088 8.8 HighSeptember 17, 2018
• pivotal application service Pivotal Usage Service in Pivotal Application Service, versions 2.0 prior to 2.0.21 and 2.1 prior... CVE-2018-11086 8.8 HighSeptember 17, 2018
• Show olderLoading…