CVE-2018-1266: Improper Limitation of a Pathname to a Restricted Directory

Cloud Foundry Cloud Controller, versions prior to 1.52.0, contains information disclosure and path traversal vulnerabilities. An authenticated malicious user can predict the location of application blobs and leverage path traversal to create a malicious application that has the ability to overwri...

PT-2018-11315

Name of the Vulnerable Software and Affected Versions Cloud Foundry Cloud Controller versions prior to 1.52.0 Description The issue allows an authenticated malicious user to predict the location of application blobs and leverage path traversal to create a malicious application. This malicious...

PT-2018-11108

Name of the Vulnerable Software and Affected Versions Cloud Foundry BOSH CLI versions prior to v3.0.1 Description The issue is related to improper access control. A user with access to an instance using the BOSH CLI can access the BOSH CLI configuration file and use its contents to perform...

CVE-2018-1267: Silk permits routing to all applications if ASG overlaps with overlay network | Cloud Foundry

Severity Medium Vendor Cloud Foundry Foundation Affected Cloud Foundry Products and Versions You are using Silk release version prior to 0.2.0 You are using cf-deployment with experimental ops file ‘use-silk-release.yml’ version prior to 1.21.0 Description Cloud Foundry Silk CNI plugin, versions...

CVE-2018-1231: BOSH CLI does not restrict access to configuration file | Cloud Foundry

Severity Medium Vendor Cloud Foundry Foundation Affected Cloud Foundry Products and Versions You are using BOSH CLI version prior to v3.0.1 Description Cloud Foundry BOSH CLI, versions prior to v3.0.1, contains an improper access control vulnerability. A user with access to an instance using the...

CVE-2018-1266: Cloud Controller file modification via malicious application | Cloud Foundry

Severity Critical Vendor Cloud Foundry Foundation Affected Cloud Foundry Products and Versions You are using Cloud Controller version prior to 1.52.0 You are using cf-deployment version prior to 1.21.0 Description Cloud Foundry Cloud Controller, versions prior to 1.52.0, contains information...

apply.frankstonfoundry.com XSS vulnerability

Open Bug Bounty ID: OBB-584240 Description| Value ---|--- Affected Website:| apply.frankstonfoundry.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Cloud Controller, cf-deployment and cf-release authentication vulnerabilities

Cloud Foundry is an open source Platform-as-a-Service PaaS cloud computing platform from the Cloud Foundry Foundation in the United States, which provides container scheduling, continuous delivery, and automated service deployment, among other features. cf-release is a release version of CF...

Pivotal Cloud Foundry cf-deployment and routing-release denial of service vulnerabilities

Pivotal Cloud Foundry CF is a suite of open source Platform-as-a-Service PaaS cloud computing platforms from Pivotal Software in the United States, which provides container scheduling, continuous delivery, and automated service deployment, among other things. cf-deployment is its development...

Cloud Foundry Windows Stemcells Information Disclosure Vulnerability

Cloud Foundry Windows Stemcells are a set of specially crafted operating system images that contain the file systems of BOSH-managed virtual machines. A security vulnerability exists in Cloud Foundry Windows Stemcells versions prior to 1200.14. An attacker could exploit the vulnerability to obtai...

File Traversal

github.com/cloudfoundry-attic/garden-linux is vulnerable to file traversal attacks. The garden-linux nstar executable allows attackers to read files within the host system that the BOSH-created vcap user has permission to read. This can be done by staging an application on Cloud Foundry using Die...

Pivotal Application Service Apps Manager for PCF Information Disclosure Vulnerability

Pivotal Application Service is a suite of application management software from Pivotal Software, U.S.A. Apps Manager for PCF is one of the application managers for PCF. \ A security vulnerability exists in Apps Manager for PCF in Pivotal Application Service versions 1.11.x before 1.11.26, 1.12.x...

CVE-2018-1221

In cf-deployment before 1.14.0 and routing-release before 0.172.0, the Cloud Foundry Gorouter mishandles WebSocket requests for AWS Application Load Balancers ALBs and some other HTTP-aware Load Balancers. A user with developer privileges could use this vulnerability to steal data or cause denial...

Design/Logic Flaw

In cf-deployment before 1.14.0 and routing-release before 0.172.0, the Cloud Foundry Gorouter mishandles WebSocket requests for AWS Application Load Balancers ALBs and some other HTTP-aware Load Balancers. A user with developer privileges could use this vulnerability to steal data or cause denial...

CVE-2018-1221

In cf-deployment before 1.14.0 and routing-release before 0.172.0, the Cloud Foundry Gorouter mishandles WebSocket requests for AWS Application Load Balancers ALBs and some other HTTP-aware Load Balancers. A user with developer privileges could use this vulnerability to steal data or cause denial...

CVE-2018-1221

In cf-deployment before 1.14.0 and routing-release before 0.172.0, the Cloud Foundry Gorouter mishandles WebSocket requests for AWS Application Load Balancers ALBs and some other HTTP-aware Load Balancers. A user with developer privileges could use this vulnerability to steal data or cause denial...

CVE-2018-1221

In CVE-2018-1221, the Cloud Foundry Gorouter mishandles WebSocket requests for AWS Application Load Balancers (ALBs) and other HTTP-aware Load Balancers. Affected products are cf-deployment (all versions before 1.14.0) and routing-release (all versions before 0.172.0). The underlying root cause i...

CVE-2015-5350

In Garden versions 0.22.0-0.329.0, a vulnerability has been discovered in the garden-linux nstar executable that allows access to files on the host system. By staging an application on Cloud Foundry using Diego and Garden installations with a malicious custom buildpack an end user could read file...

Code injection

In Garden versions 0.22.0-0.329.0, a vulnerability has been discovered in the garden-linux nstar executable that allows access to files on the host system. By staging an application on Cloud Foundry using Diego and Garden installations with a malicious custom buildpack an end user could read file...

CVE-2015-5350

In Garden versions 0.22.0-0.329.0, a vulnerability has been discovered in the garden-linux nstar executable that allows access to files on the host system. By staging an application on Cloud Foundry using Diego and Garden installations with a malicious custom buildpack an end user could read file...