CVE-2015-5350

CVE-2015-5350 affects Garden Linux via the garden-linux nstar executable in Garden versions 0.22.0–0.329.0. An attacker staging an application on Cloud Foundry (Diego and Garden) with a malicious custom buildpack could read host-system files that the vcap user can read and package them into the a...

PT-2018-10918 · Cloud Foundry · Cf-Release +2

Name of the Vulnerable Software and Affected Versions: Cloud Controller versions prior to 1.46.0 cf-deployment versions prior to 1.3.0 cf-release versions prior to 283 Description: The issue allows refresh tokens to be used for authentication where access tokens are expected. This exposes a...

PT-2018-4400

Name of the Vulnerable Software and Affected Versions Garden versions 0.22.0 through 0.329.0 Description A vulnerability has been discovered in the garden-linux nstar executable of Garden, allowing access to files on the host system. This issue can be exploited by staging an application on Cloud...

CVE-2018-1221: Improper Input Validation

In cf-deployment before 1.14.0 and routing-release before 0.172.0, the Cloud Foundry Gorouter mishandles WebSocket requests for AWS Application Load Balancers ALBs and some other HTTP-aware Load Balancers. A user with developer privileges could use this vulnerability to steal data or cause denial...

CVE-2015-5350: Improper Access Control

In Garden versions 0.22.0-0.329.0, a vulnerability has been discovered in the garden-linux nstar executable that allows access to files on the host system. By staging an application on Cloud Foundry using Diego and Garden installations with a malicious custom buildpack an end user could read file...

PT-2018-11056

Name of the Vulnerable Software and Affected Versions Cloud Foundry cf-deployment versions prior to 1.14.0 Cloud Foundry routing-release versions prior to 0.172.0 Description The Cloud Foundry Gorouter mishandles WebSocket requests for AWS Application Load Balancers ALBs and some other HTTP-aware...

CVE-2016-9880

The GemFire broker for Cloud Foundry 1.6.x before 1.6.5 and 1.7.x before 1.7.1 has multiple API endpoints which do not require authentication and could be used to gain access to the cluster managed by the broker...

CVE-2016-9880

The GemFire broker for Cloud Foundry 1.6.x before 1.6.5 and 1.7.x before 1.7.1 has multiple API endpoints which do not require authentication and could be used to gain access to the cluster managed by the broker...

Authentication flaw

The GemFire broker for Cloud Foundry 1.6.x before 1.6.5 and 1.7.x before 1.7.1 has multiple API endpoints which do not require authentication and could be used to gain access to the cluster managed by the broker...

CVE-2018-1200

Apps Manager for PCF Pivotal Application Service 1.11.x before 1.11.26, 1.12.x before 1.12.14, and 2.0.x before 2.0.5 allows unprivileged remote file read in its container via specially-crafted links...

CVE-2016-9880

The GemFire broker for Cloud Foundry 1.6.x before 1.6.5 and 1.7.x before 1.7.1 has multiple API endpoints which do not require authentication and could be used to gain access to the cluster managed by the broker...

CVE-2016-9880

CVE-2016-9880 affects the GemFire broker for Cloud Foundry 1.6.x prior to 1.6.5 and 1.7.x prior to 1.7.1. The issue is that multiple API endpoints do not require authentication, enabling access to the cluster managed by the broker. According to the CVE entry, this leads to potential unauthorized ...

PT-2018-5118

Name of the Vulnerable Software and Affected Versions GemFire broker for Cloud Foundry versions 1.6.x through 1.6.4 GemFire broker for Cloud Foundry versions 1.7.x through 1.7.0 Description The issue concerns multiple API endpoints that do not require authentication, potentially allowing...

CVE-2016-9880: Improper Authentication

The GemFire broker for Cloud Foundry 1.6.x before 1.6.5 and 1.7.x before 1.7.1 has multiple API endpoints which do not require authentication and could be used to gain access to the cluster managed by the broker...

USN-3501-1: libxcursor vulnerability | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description It was discovered that libxcursor incorrectly handled certain files. An attacker could use these issues to cause libxcursor to crash, resulting in a denial of service, or possibly execute arbitrary code...

CVE-2018-1195: Cloud Controller API will accept a refresh token for authentication | Cloud Foundry

Severity High Vendor Cloud Foundry Foundation Affected Cloud Foundry Products and Versions You are using Cloud Controller version prior to 1.46.0 You are using cf-deployment version prior to 1.3.0 You are using cf-release version prior to 283 Description Cloud Controller accepts refresh tokens fo...

USN-3582-2: Linux kernel (Xenial HWE) vulnerabilities | Cloud Foundry

Severity High Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description USN-3582-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement HWE kernel from Ubuntu 16.04 LTS for Ubuntu 14.04...

USN-3547-1: Libtasn1 vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description It was discovered that Libtasn1 incorrectly handled certain files. If a user were tricked into opening a crafted file, an attacker could possibly use this to cause a denial of service. This issue only...

USN-3554-1: curl vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description It was discovered that curl incorrectly handled certain data. An attacker could possibly use this to cause a denial of service or even to get access to sensitive data. This issue only affected Ubuntu 16.0...

USN-3543-1: rsync vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Description It was discovered that rsync incorrectly handled certain data input. An attacker could possibly use this to cause a denial of service or execute arbitrary code. CVE-2017-16548 It was discovered that rsync...