CVE-2019-3787

Cloud Foundry UAA, versions prior to 73.0.0, falls back to appending “unknown.org” to a user's email address when one is not provided and the user name does not contain an @ character. This domain is held by a private company, which leads to attack vectors including password recovery emails sent ...

CVE-2019-3787

Cloud Foundry UAA, versions prior to 73.0.0, falls back to appending “unknown.org” to a user's email address when one is not provided and the user name does not contain an @ character. This domain is held by a private company, which leads to attack vectors including password recovery emails sent ...

Design/Logic Flaw

Cloud Foundry UAA, versions prior to 73.0.0, falls back to appending “unknown.org” to a user's email address when one is not provided and the user name does not contain an @ character. This domain is held by a private company, which leads to attack vectors including password recovery emails sent ...

CVE-2019-3787

Cloud Foundry UAA vulnerability CVE-2019-3787 affects UAA releases prior to v73.0.0. When a user email is not provided or the username lacks an @, UAA falls back to appending unknown.org to the email, which means password-recovery emails can be sent to an owned domain. This creates a potential ta...

CVE-2019-3787 UAA defaults email address to an insecure domain

Cloud Foundry UAA, versions prior to 73.0.0, falls back to appending “unknown.org” to a user's email address when one is not provided and the user name does not contain an @ character. This domain is held by a private company, which leads to attack vectors including password recovery emails sent ...

CVE-2019-3787

Cloud Foundry UAA, versions prior to 73.0.0, falls back to appending “unknown.org” to a user's email address when one is not provided and the user name does not contain an @ character. This domain is held by a private company, which leads to attack vectors including password recovery emails sent ...

CVE-2019-11271

Cloud Foundry BOSH 270.x versions prior to v270.1.1, contain a BOSH Director that does not properly redact credentials when configured to use a MySQL database. A local authenticated malicious user may read any credentials that are contained in a BOSH manifest...

CVE-2019-11271

Cloud Foundry BOSH 270.x versions prior to v270.1.1, contain a BOSH Director that does not properly redact credentials when configured to use a MySQL database. A local authenticated malicious user may read any credentials that are contained in a BOSH manifest...

Design/Logic Flaw

Cloud Foundry BOSH 270.x versions prior to v270.1.1, contain a BOSH Director that does not properly redact credentials when configured to use a MySQL database. A local authenticated malicious user may read any credentials that are contained in a BOSH manifest...

PT-2019-16717

Name of the Vulnerable Software and Affected Versions Cloud Foundry UAA versions prior to 73.0.0 Description The issue allows for potential account takeover through password recovery emails sent to a potentially fraudulent address. When a user's email address is not provided and the username does...

CVE-2019-3787: Weak Password Recovery Mechanism for Forgotten Password

Cloud Foundry UAA, versions prior to 73.0.0, falls back to appending “unknown.org” to a user's email address when one is not provided and the user name does not contain an @ character. This domain is held by a private company, which leads to attack vectors including password recovery emails sent ...

CVE-2019-11271

Cloud Foundry BOSH 270.x versions prior to v270.1.1, contain a BOSH Director that does not properly redact credentials when configured to use a MySQL database. A local authenticated malicious user may read any credentials that are contained in a BOSH manifest...

CVE-2019-11271

Cloud Foundry BOSH 270.x versions prior to 270.1.1 contain a BOSH Director that does not redact credentials when configured to use a MySQL database. A local authenticated attacker can read credentials contained in a BOSH manifest. Affected product/version: Cloud Foundry BOSH (270.x) before 270.1....

CVE-2019-11271 Bosh Deployment logs leak sensitive information

Cloud Foundry BOSH 270.x versions prior to v270.1.1, contain a BOSH Director that does not properly redact credentials when configured to use a MySQL database. A local authenticated malicious user may read any credentials that are contained in a BOSH manifest...

PT-2019-12219

Name of the Vulnerable Software and Affected Versions Cloud Foundry BOSH versions prior to 270.1.1 Description The issue concerns a problem with the BOSH Director in Cloud Foundry BOSH, where it fails to properly redact credentials when configured to use a MySQL database. This could allow a local...

CVE-2019-11271: Insertion of Sensitive Information into Log File

Cloud Foundry BOSH 270.x versions prior to v270.1.1, contain a BOSH Director that does not properly redact credentials when configured to use a MySQL database. A local authenticated malicious user may read any credentials that are contained in a BOSH manifest...

Cloud Foundry BOSH Information Disclosure Vulnerability

Cloud Foundry is a suite of open source Platform-as-a-Service PaaS cloud computing platforms from the U.S.-based Cloud Foundry Foundation. The product provides features such as container scheduling, continuous delivery and automated service deployment. An information disclosure vulnerability exis...

USN-4008-2: AppArmor update | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Description USN-4008-1 fixed multiple security issues in the Linux kernel. This update provides the corresponding changes to AppArmor policy for correctly operating under the Linux kernel with fixes for CVE-2019-1119...

USN-4004-1: Berkeley DB vulnerability | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Description It was discovered that Berkeley DB incorrectly handled certain inputs. An attacker could possibly use this issue to read sensitive information. CVEs contained in this USN include:...

USN-4012-1: elfutils vulnerabilities | Cloud Foundry

Severity Low Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Canonical Ubuntu 18.04 Description It was discovered that elfutils incorrectly handled certain malformed files. If a user or automated system were tricked into processing a specially crafted file, elfutils could be made...