MS-ISAC: 2018-046 - Multiple Vulnerabilities in PHP | Cloud Foundry

Severity Critical Vendor Cloud Foundry Foundation Affected Cloud Foundry Products and Versions You are using php-buildpack prior to version 4.3.53 Description Multiple upstream vulnerabilities have been discovered in all supported PHP versions in the PHP buildpack. MS-ISAC reports that the most...

CVE-2016-2169

Cloud Foundry Cloud Controller, capi-release versions prior to 1.0.0 and cf-release versions prior to v237, contain a business logic flaw. An application developer may create an application with a route that conflicts with a platform service route and receive traffic intended for the service...

Code injection

Cloud Foundry Cloud Controller, capi-release versions prior to 1.0.0 and cf-release versions prior to v237, contain a business logic flaw. An application developer may create an application with a route that conflicts with a platform service route and receive traffic intended for the service...

CVE-2016-2169

Cloud Foundry Cloud Controller, capi-release versions prior to 1.0.0 and cf-release versions prior to v237, contain a business logic flaw. An application developer may create an application with a route that conflicts with a platform service route and receive traffic intended for the service...

CVE-2016-2169

Cloud Foundry Cloud Controller, capi-release versions prior to 1.0.0 and cf-release versions prior to v237, contain a business logic flaw. An application developer may create an application with a route that conflicts with a platform service route and receive traffic intended for the service...

CVE-2016-2169

Cloud Foundry CVE-2016-2169 affects Cloud Foundry Cloud Controller: capi-release versions before 1.0.0 and cf-release versions before v237. The issue is a business-logic flaw where an application could create a route that conflicts with a platform service route, causing traffic intended for the s...

CVE-2016-2169: Undefined Security Weakness

Cloud Foundry Cloud Controller, capi-release versions prior to 1.0.0 and cf-release versions prior to v237, contain a business logic flaw. An application developer may create an application with a route that conflicts with a platform service route and receive traffic intended for the service...

PT-2018-4903

Name of the Vulnerable Software and Affected Versions Cloud Foundry Cloud Controller, capi-release versions prior to 1.0.0 Cloud Foundry Cloud Controller, cf-release versions prior to v237 Description The issue is related to a business logic flaw. An application developer may create an applicatio...

Cloud Foundry Garden-runC Information Disclosure Vulnerability

Cloud Foundry Garden-runC is a set of Garden-based container systems from the U.S. Cloud Foundry Foundation. An information disclosure vulnerability exists in Cloud Foundry Garden-runC versions prior to 1.11.0. An attacker can exploit this vulnerability to obtain credentials and perform...

USN-3598-1: curl vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description Phan Thanh discovered that curl incorrectly handled certain FTP paths. An attacker could use this to cause a denial of service or possibly execute arbitrary code. CVE-2018-1000120 Dario Weisser discovered...

CVE-2016-0898

MySQL for PCF tiles 1.7.x before 1.7.10 were discovered to log the AWS access key in plaintext. These credentials were logged to the Service Backup component logs, and not the system log, thus were not exposed outside the Service Backup VM...

CVE-2018-1191

Cloud Foundry Garden-runC, versions prior to 1.11.0, contains an information exposure vulnerability. A user with access to Garden logs may be able to obtain leaked credentials and perform authenticated actions using those credentials...

CVE-2018-1191

Cloud Foundry Garden-runC, versions prior to 1.11.0, contains an information exposure vulnerability. A user with access to Garden logs may be able to obtain leaked credentials and perform authenticated actions using those credentials...

Information disclosure

Cloud Foundry Garden-runC, versions prior to 1.11.0, contains an information exposure vulnerability. A user with access to Garden logs may be able to obtain leaked credentials and perform authenticated actions using those credentials...

CVE-2018-1191

Cloud Foundry Garden-runC, versions prior to 1.11.0, contains an information exposure vulnerability. A user with access to Garden logs may be able to obtain leaked credentials and perform authenticated actions using those credentials...

CVE-2018-1191

CVE-2018-1191 affects Cloud Foundry Garden-runC prior to 1.11.0. The vulnerability is an information disclosure where a user with access to Garden logs can obtain leaked credentials and perform authenticated actions. Affected components include garden-runc-release (before 1.11.0) and cf-deploymen...

Cloud Foundry Silk CNI Plugin Access Control Error Vulnerability

Cloud Foundry CF is the U.S. Cloud Foundry Foundation's set of open source platform-as-a-service PaaS cloud computing platform , which provides container scheduling , continuous delivery and automated service deployment and other functions . Silk CNI plugin is one of the CNI-compatible use of...

Cloud Foundry Cloud Controller Path Traversal Vulnerability

Cloud Foundry is an open source Platform-as-a-Service PaaS cloud computing platform from the Cloud Foundry Foundation, which provides container scheduling, continuous delivery, and automated service deployment.Cloud Controller is one of the cloud controllers. A path traversal vulnerability exists...

Cloud Foundry BOSH CLI Access Control Error Vulnerability

Cloud Foundry CF is a set of open source Platform-as-a-Service PaaS cloud computing platforms from the U.S.-based Cloud Foundry Foundation, which provides container scheduling, continuous delivery, and automated service deployment.BOSH CLI is one of the command-line tools. An access control error...

CVE-2018-1191: Insertion of Sensitive Information Into Debugging Code

Cloud Foundry Garden-runC, versions prior to 1.11.0, contains an information exposure vulnerability. A user with access to Garden logs may be able to obtain leaked credentials and perform authenticated actions using those credentials...