PT-2019-12221 · Cloud Foundry · Cloud Foundry Uaa

Name of the Vulnerable Software and Affected Versions: Cloud Foundry UAA versions prior to 74.0.0 Description: The issue allows a remote unauthenticated malicious attacker to craft a URL that contains a SCIM filter with malicious JavaScript. This JavaScript may be executed by older browsers,...

CVE-2019-11274: UAA SCIM Filter XSS | Cloud Foundry

Severity Medium Vendor Cloud Foundry Foundation Affected Cloud Foundry Products and Versions UAA Release OSS All versions prior to v74.0.0 Description Cloud Foundry UAA, versions prior to 74.0.0, is vulnerable to an XSS attack. A remote unauthenticated malicious attacker could craft a URL that...

CVE-2019-11270

Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or scope can bypass the restrictions imposed on clients created via 'clients.write' and create clients with arbitrary scopes that the creator does not possess...

CVE-2019-11270

Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or scope can bypass the restrictions imposed on clients created via 'clients.write' and create clients with arbitrary scopes that the creator does not possess...

Design/Logic Flaw

Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or scope can bypass the restrictions imposed on clients created via 'clients.write' and create clients with arbitrary scopes that the creator does not possess...

CVE-2019-11270

Cloud Foundry UAA before v73.4.0 is affected. A malicious client with the clients.write authority can bypass restrictions on clients created via clients.write and create clients with arbitrary scopes the creator does not possess. Affected product: Cloud Foundry UAA (OSS) prior to v73.4.0. Impact:...

CVE-2019-11270 UAA clients.write vulnerability

Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or scope can bypass the restrictions imposed on clients created via 'clients.write' and create clients with arbitrary scopes that the creator does not possess...

PT-2019-12218

Name of the Vulnerable Software and Affected Versions Cloud Foundry UAA versions prior to 73.4.0 Description The issue allows a malicious client with the clients.write authority or scope to bypass restrictions and create clients with arbitrary scopes that the creator does not possess. This can le...

CVE-2019-11270: Improper Privilege Management

Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or scope can bypass the restrictions imposed on clients created via 'clients.write' and create clients with arbitrary scopes that the creator does not possess...

Cloud Foundry UAA Security Bypass Vulnerability

Cloud Foundry UAA is an authentication and managed service endpoint for the CloudFoundry cloud platform from the Cloud Foundry Foundation in the United States. A security bypass vulnerability exists in Cloud Foundry UAA, which can be exploited by attackers to bypass restrictions...

CVE-2019-11270: UAA clients.write vulnerability | Cloud Foundry

Severity High Vendor Cloud Foundry Foundation Description Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the ‘clients.write’ authority or scope can bypass the restrictions imposed on clients created via ‘clients.write’ and create clients wi...

USN-4041-1: Linux kernel update | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Description USN-4017-1 fixed vulnerabilities in the Linux kernel for Ubuntu. Unfortunately, the update introduced a regression that interfered with networking applications that setup very low SOSNDBUF values. This...

Cloud Foundry UAA Input Validation Error Vulnerability

Cloud Foundry UAA is an authentication and managed service endpoint for the CloudFoundry cloud platform from the Cloud Foundry Foundation in the United States. A security vulnerability exists in Cloud Foundry UAA versions prior to 73.4.0 that stems from the program not setting the X-FRAME-OPTIONS...

CVE-2019-3794

Cloud Foundry UAA, versions prior to v73.4.0, does not set an X-FRAME-OPTIONS header on various endpoints. A remote user can perform clickjacking attacks on UAA's frontend sites...

CVE-2019-3794

Cloud Foundry UAA, versions prior to v73.4.0, does not set an X-FRAME-OPTIONS header on various endpoints. A remote user can perform clickjacking attacks on UAA's frontend sites...

Code injection

Cloud Foundry UAA, versions prior to v73.4.0, does not set an X-FRAME-OPTIONS header on various endpoints. A remote user can perform clickjacking attacks on UAA's frontend sites...

CVE-2019-3794 UAA - Login app subject to clickjacking attack

Cloud Foundry UAA, versions prior to v73.4.0, does not set an X-FRAME-OPTIONS header on various endpoints. A remote user can perform clickjacking attacks on UAA's frontend sites...

CVE-2019-3794

CVE-2019-3794 affects Cloud Foundry UAA versions prior to 73.4.0, where the X-FRAME-OPTIONS header is not set on multiple endpoints, enabling potential clickjacking of UAA frontend sites. The issue is confirmed across multiple sources (NVD/CNVD/CVELIST entries and Cloud Foundry advisories). Affec...

CVE-2019-3794: Improper Access Control

Cloud Foundry UAA, versions prior to v73.4.0, does not set an X-FRAME-OPTIONS header on various endpoints. A remote user can perform clickjacking attacks on UAA's frontend sites...

PT-2019-16724

Name of the Vulnerable Software and Affected Versions Cloud Foundry UAA versions prior to 73.4.0 Description The issue allows a remote user to perform clickjacking attacks on UAA's frontend sites due to the absence of an X-FRAME-OPTIONS header on various endpoints. Recommendations For versions...