CVE-2016-5016

Pivotal Cloud Foundry 239 and earlier, UAA aka User Account and Authentication Server 3.4.1 and earlier, UAA release 12.2 and earlier, PCF aka Pivotal Cloud Foundry Elastic Runtime 1.6.x before 1.6.35, and PCF Elastic Runtime 1.7.x before 1.7.13 does not validate if a certificate is expired...

CVE-2016-5016

Pivotal Cloud Foundry 239 and earlier, UAA aka User Account and Authentication Server 3.4.1 and earlier, UAA release 12.2 and earlier, PCF aka Pivotal Cloud Foundry Elastic Runtime 1.6.x before 1.6.35, and PCF Elastic Runtime 1.7.x before 1.7.13 does not validate if a certificate is expired...

CVE-2016-5016: Improper Certificate Validation

Pivotal Cloud Foundry 239 and earlier, UAA aka User Account and Authentication Server 3.4.1 and earlier, UAA release 12.2 and earlier, PCF aka Pivotal Cloud Foundry Elastic Runtime 1.6.x before 1.6.35, and PCF Elastic Runtime 1.7.x before 1.7.13 does not validate if a certificate is expired...

PT-2017-8651

Name of the Vulnerable Software and Affected Versions Pivotal Cloud Foundry versions 239 and earlier UAA versions 3.4.1 and earlier UAA release 12.2 and earlier PCF Elastic Runtime versions 1.6.x before 1.6.35 PCF Elastic Runtime versions 1.7.x before 1.7.13 Description The issue is related to th...

Privilege Escalation

CloudFoundry User Account and Authentication UAA is vulnerable to privilege escalation. A malicious user can pass a malicious user token to an unused group endpoint to cause an escalation of privileges...

Blind SQL Injection

CloudFoundry User Account and Authentication UAA is vulnerable to blind SQL injection attacks. The attacks are possible because it does not properly validate the clientid string...

CVE-2017-4972: Blind SQL Injection in UAA | Cloud Foundry

Severity High Vendor Cloud Foundry Foundation Versions Affected cf-release versions prior to v257 UAA release: 2.x versions prior to v2.7.4.14 3.6.x versions prior to v3.6.8 3.9.x versions prior to v3.9.10 Other versions prior to v3.15.0 UAA bosh release uaa-release: 13.x versions prior to v13.12...

CVE-2017-4973: Privilege Escalation in UAA | Cloud Foundry

Severity High Vendor Cloud Foundry Foundation Versions Affected cf-release versions prior to v257 UAA release: 2.x versions prior to v2.7.4.14 3.6.x versions prior to v3.6.8 3.9.x versions prior to v3.9.10 Other versions prior to v3.15.0 UAA bosh release uaa-release: 13.x versions prior to v13.12...

CVE-2016-4468

SQL injection vulnerability in Pivotal Cloud Foundry PCF before 238; UAA 2.x before 2.7.4.4, 3.x before 3.3.0.2, and 3.4.x before 3.4.1; UAA BOSH before 11.2 and 12.x before 12.2; Elastic Runtime before 1.6.29 and 1.7.x before 1.7.7; and Ops Manager 1.7.x before 1.7.8 allows remote authenticated...

Sql injection

SQL injection vulnerability in Pivotal Cloud Foundry PCF before 238; UAA 2.x before 2.7.4.4, 3.x before 3.3.0.2, and 3.4.x before 3.4.1; UAA BOSH before 11.2 and 12.x before 12.2; Elastic Runtime before 1.6.29 and 1.7.x before 1.7.7; and Ops Manager 1.7.x before 1.7.8 allows remote authenticated...

CVE-2016-4468

SQL injection vulnerability in Pivotal Cloud Foundry PCF before 238; UAA 2.x before 2.7.4.4, 3.x before 3.3.0.2, and 3.4.x before 3.4.1; UAA BOSH before 11.2 and 12.x before 12.2; Elastic Runtime before 1.6.29 and 1.7.x before 1.7.7; and Ops Manager 1.7.x before 1.7.8 allows remote authenticated...

CVE-2016-4468

SQL injection vulnerability in Pivotal Cloud Foundry PCF before 238; UAA 2.x before 2.7.4.4, 3.x before 3.3.0.2, and 3.4.x before 3.4.1; UAA BOSH before 11.2 and 12.x before 12.2; Elastic Runtime before 1.6.29 and 1.7.x before 1.7.7; and Ops Manager 1.7.x before 1.7.8 allows remote authenticated...

CVE-2016-4468

SQL injection vulnerability in Pivotal Cloud Foundry PCF before 238; UAA 2.x before 2.7.4.4, 3.x before 3.3.0.2, and 3.4.x before 3.4.1; UAA BOSH before 11.2 and 12.x before 12.2; Elastic Runtime before 1.6.29 and 1.7.x before 1.7.7; and Ops Manager 1.7.x before 1.7.8 allows remote authenticated...

CVE-2016-4468: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Pivotal Cloud Foundry PCF before 238; UAA 2.x before 2.7.4.4, 3.x before 3.3.0.2, and 3.4.x before 3.4.1; UAA BOSH before 11.2 and 12.x before 12.2; Elastic Runtime before 1.6.29 and 1.7.x before 1.7.7; and Ops Manager 1.7.x before 1.7.8 allows remote authenticated...

Session Fixation Attacks

CloudFoundry User Account and Authentication UAA is vulnerable to session fixation attacks. These attacks are possible when UAA is configured to authenticate against OpenID Connect or external SAML based identity providers...

Denial Of Service (DoS)

CloudFoundry User Account and Authentication UAA is vulnerable to denial of service DoS attacks. These attacks are possible through the lockout feature...

CVE-2017-4963: Session Fixation for UAA External Authentication | Cloud Foundry

Severity Low Vendor Cloud Foundry Foundation Versions Affected Cloud Foundry release v252 and earlier versions UAA stand-alone release v2.0.0 – v2.7.4.12 & v3.0.0 – v3.11.0 UAA bosh release v26 & earlier versions Description UAA is vulnerable to session fixation when configured to authenticate...

CVE-2017-4960

An issue was discovered in Cloud Foundry release v247 through v252, UAA stand-alone release v3.9.0 through v3.11.0, and UAA Bosh Release v21 through v26. There is a potential to subject the UAA OAuth clients to a denial of service attack...

Design/Logic Flaw

An issue was discovered in Cloud Foundry release v247 through v252, UAA stand-alone release v3.9.0 through v3.11.0, and UAA Bosh Release v21 through v26. There is a potential to subject the UAA OAuth clients to a denial of service attack...

CVE-2017-4960

An issue was discovered in Cloud Foundry release v247 through v252, UAA stand-alone release v3.9.0 through v3.11.0, and UAA Bosh Release v21 through v26. There is a potential to subject the UAA OAuth clients to a denial of service attack...