2697 matches found
CVE-2016-5006
The Cloud Controller in Cloud Foundry before 239 logs user-provided service objects at creation, which allows attackers to obtain sensitive user credential information via unspecified vectors...
Information disclosure
The Cloud Controller in Cloud Foundry before 239 logs user-provided service objects at creation, which allows attackers to obtain sensitive user credential information via unspecified vectors...
CVE-2016-5006
The Cloud Controller in Cloud Foundry before 239 logs user-provided service objects at creation, which allows attackers to obtain sensitive user credential information via unspecified vectors...
CVE-2016-5006
The Cloud Controller in Cloud Foundry before 239 logs user-provided service objects at creation, which allows attackers to obtain sensitive user credential information via unspecified vectors...
CVE-2016-5006
Summary: CVE-2016-5006 affects the Cloud Foundry Cloud Controller prior to v239. When creating a user-provided service, the Cloud Controller logs the entire UPS object, including credentials, which could expose sensitive user credentials via unspecified vectors. Affected versions: CF releases bef...
CVE-2017-4961: BOSH Director Shell Injection Vulnerabilities | Cloud Foundry
Severity High Vendor Cloud Foundry Foundation Versions Affected BOSH Release: 261.x versions prior to 261.3 All 260.x versions Description In certain cases an authenticated Director user can provide a malicious checksum that could allow them to escalate their privileges on the Director VM...
USN-3259-1: Bind vulnerabilities | Cloud Foundry
Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description It was discovered that the resolver in Bind made incorrect assumptions about ordering when processing responses containing a CNAME or DNAME. An attacker could use this cause a denial of service...
USN-3246-1: Eject vulnerability | Cloud Foundry
Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description Ilja Van Sprundel discovered that dmcrypt-get-device incorrectly checked setuid and setgid return values. A local attacker could use this issue to execute code as an administrator. Affected Cloud Foundry...
CVE-2017-4974: Blind SQL Injection with privileged UAA endpoints | Cloud Foundry
Severity High Vendor Cloud Foundry Foundation Versions Affected cf-release versions prior to v258 UAA release: 2.x versions prior to v2.7.4.15 3.6.x versions prior to v3.6.9 3.9.x versions prior to v3.9.11 Other versions prior to v3.16.0 UAA bosh release uaa-release: 13.x versions prior to v13.13...
USN-3263-1: FreeType vulnerability | Cloud Foundry
Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description It was discovered that a heap-based buffer overflow existed in the FreeType library. If a user were tricked into using a specially crafted font file, a remote attacker could cause FreeType to crash,...
USN-3265-2: Linux kernel (Xenial HWE) vulnerabilities | Cloud Foundry
Severity High Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description USN-3265-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement HWE kernel from Ubuntu 16.04 LTS for Ubuntu 14.04...
Cloud Foundry cf-release exceeds quota vulnerability
Cloud Foundry is an open source multi-cloud application platform as a service PaaS managed by the Cloud Foundry Foundation. An out-of-quota vulnerability exists in Cloud Foundry cf-release, where the "Cloud Controller" in Cloud Foundry cf-release enables a certified developer user to exceed a...
Pivotal Software Cloud Foundry Foundation BOSH Azure CPI Code Injection Vulnerability
Pivotal Software Cloud Foundry Foundation BOSH Azure CPI is a set of open source tools for deployment and lifecycle management of distributed systems from Pivotal Software, USA. A code injection vulnerability exists in version v22 of Pivotal Software Cloud Foundry Foundation BOSH Azure CPI. An...
CVE-2016-5016
Pivotal Cloud Foundry 239 and earlier, UAA aka User Account and Authentication Server 3.4.1 and earlier, UAA release 12.2 and earlier, PCF aka Pivotal Cloud Foundry Elastic Runtime 1.6.x before 1.6.35, and PCF Elastic Runtime 1.7.x before 1.7.13 does not validate if a certificate is expired...
Code injection
Pivotal Cloud Foundry 239 and earlier, UAA aka User Account and Authentication Server 3.4.1 and earlier, UAA release 12.2 and earlier, PCF aka Pivotal Cloud Foundry Elastic Runtime 1.6.x before 1.6.35, and PCF Elastic Runtime 1.7.x before 1.7.13 does not validate if a certificate is expired...
CVE-2016-5016
Pivotal Cloud Foundry 239 and earlier, UAA aka User Account and Authentication Server 3.4.1 and earlier, UAA release 12.2 and earlier, PCF aka Pivotal Cloud Foundry Elastic Runtime 1.6.x before 1.6.35, and PCF Elastic Runtime 1.7.x before 1.7.13 does not validate if a certificate is expired...
CVE-2016-5016
Pivotal Cloud Foundry 239 and earlier, UAA aka User Account and Authentication Server 3.4.1 and earlier, UAA release 12.2 and earlier, PCF aka Pivotal Cloud Foundry Elastic Runtime 1.6.x before 1.6.35, and PCF Elastic Runtime 1.7.x before 1.7.13 does not validate if a certificate is expired...
CVE-2016-5016
CVE-2016-5016 affects Pivotal Cloud Foundry and related UAA components: CF v239 and earlier, UAA 3.4.1 and earlier (and v12.2 and earlier), and Elastic Runtime 1.6.x before 1.6.35 / 1.7.x before 1.7.13. The root cause is that the TrustManager used by OpenJDK did not validate certificate expiratio...