CVE-2016-4468 UAA SQL Injection | Cloud Foundry

High Vendor Cloud Foundry Foundation Versions Affected Cloud Foundry release v237 and earlier versions UAA release v3.4.0 and earlier versions UAA release V12 and earlier versions Description There is the potential for a SQL injection attack in UAA for authenticated users. Mitigation OSS users ar...

CVE-2016-3084 UAA Password Reset Vulnerability | Cloud Foundry

CVE-2016-3084 UAA Password Reset Vulnerability Low Vendor Cloud Foundry Foundation Versions Affected Cloud Foundry release v236 and earlier versions UAA release v3.3.0 and earlier versions All versions of Login-server UAA release v10 and earlier versions Description The UAA reset password flow is...

CVE-2015-5170-5173 UAA Vulnerabilities | Cloud Foundry

CVE-2015-5170-5173 UAA Vulnerabilities Low Vendor Cloud Foundry Foundation Versions Affected cf-release versions v215 & prior UAA versions 2.5.1 & prior Description CSRF Attack on PWS. It is possible to log the user into another account instead of the account they intended to log into because of...

CVE-2016-0732 Privilege Escalation | Cloud Foundry

CVE-2016-0732 Privilege Escalation Critical Vendor Cloud Foundry Foundation Versions Affected Cloud Foundry v208 through v229 UAA v2.0.0 – v2.7.3 & v3.0.0 UAA-Release v2 through v4 Description A privilege elevation vulnerability has been identified with the identity zones feature of UAA. Users wi...

CVE-2015-3191 - CSRF attack on change email | Cloud Foundry

CVE-2015-3191 – CSRF attack on change email Low Vendor Cloud Foundry Foundation Versions Affected cf-release versions prior to v210 UAA versions prior to 2.3.0 Description The changeemail form in UAA is vulnerable to a CSRF attack. This allows an attacker to trigger an e-mail change for a user...

CVE-2015-3189 - Expire old reset password links | Cloud Foundry

CVE-2015-3189 – Expire old reset password links Low Vendor Cloud Foundry Foundation Versions Affected cf-release versions prior to v209 UAA versions prior to 2.2.6 Description Old Password Reset Links are not expired after the user changes their current email address to a new one. This...

CVE-2015-3190 - Open redirect on Login | Cloud Foundry

CVE-2015-3190 – Open redirect on Login Low Vendor Cloud Foundry Foundation Versions Affected cf-release versions prior to v210 UAA versions prior to 2.3.0 Description The UAA logout link is susceptible to an open redirect which allows an attacker to insert malicious web page as a redirect...