Design/Logic Flaw

Applications deployed to Cloud Foundry, versions v166 through v227, may be vulnerable to a remote disclosure of information, including, but not limited to environment variables and bound service details. For applications to be vulnerable, they must have been staged using automatic buildpack...

CVE-2016-0708

Applications deployed to Cloud Foundry, versions v166 through v227, may be vulnerable to a remote disclosure of information, including, but not limited to environment variables and bound service details. For applications to be vulnerable, they must have been staged using automatic buildpack...

CVE-2016-0708

CVE-2016-0708 affects Cloud Foundry deployments using the Cloud Foundry Java Buildpack (versions 2.0–3.4). Vulnerable when apps are staged with automatic buildpack detection, pass the Java Buildpack detection script, and serve static content from the deployed artifact; the default Tomcat configur...

CVE-2016-0708

Applications deployed to Cloud Foundry, versions v166 through v227, may be vulnerable to a remote disclosure of information, including, but not limited to environment variables and bound service details. For applications to be vulnerable, they must have been staged using automatic buildpack...

CVE-2016-0708: Exposure of Sensitive Information to an Unauthorized Actor

Applications deployed to Cloud Foundry, versions v166 through v227, may be vulnerable to a remote disclosure of information, including, but not limited to environment variables and bound service details. For applications to be vulnerable, they must have been staged using automatic buildpack...

PT-2018-4624

Name of the Vulnerable Software and Affected Versions Cloud Foundry versions v166 through v227 Description The issue allows for remote disclosure of information, including environment variables and bound service details, in applications deployed to Cloud Foundry. This affects applications that we...

USN-3696-2: Linux kernel (Xenial HWE) vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description USN-3696-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement HWE kernel from Ubuntu 16.04 LTS for Ubuntu 14.0...

USN-3692-1: OpenSSL vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description Keegan Ryan discovered that OpenSSL incorrectly handled ECDSA key generation. An attacker could possibly use this issue to perform a cache-timing attack and recover private ECDSA keys. CVE-2018-0495 Guido...

USN-3693-1: JasPer vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description Affected Cloud Foundry Products and Versions Severity is medium unless otherwise noted. All versions of Cloud Foundry cflinuxfs2 prior to 1.222.0 Mitigation OSS users are strongly encouraged to follow one...

USN-3689-1: Libgcrypt vulnerability | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description Affected Cloud Foundry Products and Versions Severity is medium unless otherwise noted. Cloud Foundry BOSH stemcells are vulnerable, including: 3586.x versions prior to 3586.25 3541.x versions prior to...

Open Redirect

Cloud Foundry UAA is vulnerable to open redirect attacks. The vulnerability is possible because it does not check the redirection link on a form parameter after an authenticated user clicks on a link used for internal UAA redirects on the login page, allowing an attacker to create a link to...

Cloud Foundry UAA and uaa-release open redirection vulnerabilities

Cloud Foundry UAA and uaa-release are both different versions of the U.S. Cloud Foundry Foundation's authentication and management service endpoints applied to the Cloud Foundry Cloud Platform. A security vulnerability exists in Cloud Foundry UAA and uaa-release that stems from the program's...

CVE-2018-11041

Cloud Foundry UAA, versions later than 4.6.0 and prior to 4.19.0 except 4.10.1 and 4.7.5 and uaa-release versions later than v48 and prior to v60 except v55.1 and v52.9, does not validate redirect URL values on a form parameter used for internal UAA redirects on the login page, allowing open...

Open redirect

Cloud Foundry UAA, versions later than 4.6.0 and prior to 4.19.0 except 4.10.1 and 4.7.5 and uaa-release versions later than v48 and prior to v60 except v55.1 and v52.9, does not validate redirect URL values on a form parameter used for internal UAA redirects on the login page, allowing open...

CVE-2018-11041

Cloud Foundry UAA, versions later than 4.6.0 and prior to 4.19.0 except 4.10.1 and 4.7.5 and uaa-release versions later than v48 and prior to v60 except v55.1 and v52.9, does not validate redirect URL values on a form parameter used for internal UAA redirects on the login page, allowing open...

CVE-2018-11041

CVE-2018-11041 affects Cloud Foundry UAA and uaa-release: open redirect vulnerability due to lack of validation of the redirect URL in a form parameter used for internal login redirects. Affected: UAA versions >4.6.0 and v48 and

CVE-2018-11041

Cloud Foundry UAA, versions later than 4.6.0 and prior to 4.19.0 except 4.10.1 and 4.7.5 and uaa-release versions later than v48 and prior to v60 except v55.1 and v52.9, does not validate redirect URL values on a form parameter used for internal UAA redirects on the login page, allowing open...

CVE-2018-11041

Cloud Foundry UAA, versions later than 4.6.0 and prior to 4.19.0 except 4.10.1 and 4.7.5 and uaa-release versions later than v48 and prior to v60 except v55.1 and v52.9, does not validate redirect URL values on a form parameter used for internal UAA redirects on the login page, allowing open...

PT-2018-10261

Name of the Vulnerable Software and Affected Versions Cloud Foundry UAA versions later than 4.6.0 and prior to 4.19.0, excluding versions 4.10.1 and 4.7.5 uaa-release versions later than v48 and prior to v60, excluding versions v55.1 and v52.9 Description The issue allows open redirects due to a...

CVE-2018-11041: URL Redirection to Untrusted Site

Cloud Foundry UAA, versions later than 4.6.0 and prior to 4.19.0 except 4.10.1 and 4.7.5 and uaa-release versions later than v48 and prior to v60 except v55.1 and v52.9, does not validate redirect URL values on a form parameter used for internal UAA redirects on the login page, allowing open...