Denial of service

Cloud Foundry Loggregator, versions 89.x prior to 89.5 or 96.x prior to 96.1 or 99.x prior to 99.1 or 101.x prior to 101.9 or 102.x prior to 102.2, does not handle errors thrown while constructing certain http requests. A remote authenticated user may construct malicious requests to cause the...

CVE-2018-1269

Cloud Foundry Loggregator, versions 89.x prior to 89.5 or 96.x prior to 96.1 or 99.x prior to 99.1 or 101.x prior to 101.9 or 102.x prior to 102.2, does not handle errors thrown while constructing certain http requests. A remote authenticated user may construct malicious requests to cause the...

Design/Logic Flaw

Cloud Foundry Diego, release versions prior to 2.8.0, does not properly sanitize file paths in tar and zip files headers. A remote attacker with CF admin privileges can upload a malicious buildpack that will allow a complete takeover of a Diego Cell VM and access to all apps running on that Diego...

CVE-2018-1268

Cloud Foundry Loggregator, versions 89.x prior to 89.5 or 96.x prior to 96.1 or 99.x prior to 99.1 or 101.x prior to 101.9 or 102.x prior to 102.2, does not validate app GUID structure in requests. A remote authenticated malicious user knowing the GUID of an app may construct malicious requests t...

Code injection

Cloud Foundry Loggregator, versions 89.x prior to 89.5 or 96.x prior to 96.1 or 99.x prior to 99.1 or 101.x prior to 101.9 or 102.x prior to 102.2, does not validate app GUID structure in requests. A remote authenticated malicious user knowing the GUID of an app may construct malicious requests t...

CVE-2018-1265

Cloud Foundry Diego, release versions prior to 2.8.0, does not properly sanitize file paths in tar and zip files headers. A remote attacker with CF admin privileges can upload a malicious buildpack that will allow a complete takeover of a Diego Cell VM and access to all apps running on that Diego...

CVE-2018-1269

Cloud Foundry Loggregator, versions 89.x prior to 89.5 or 96.x prior to 96.1 or 99.x prior to 99.1 or 101.x prior to 101.9 or 102.x prior to 102.2, does not handle errors thrown while constructing certain http requests. A remote authenticated user may construct malicious requests to cause the...

CVE-2018-1269

Cloud Foundry Loggregator, versions 89.x prior to 89.5 or 96.x prior to 96.1 or 99.x prior to 99.1 or 101.x prior to 101.9 or 102.x prior to 102.2, does not handle errors thrown while constructing certain http requests. A remote authenticated user may construct malicious requests to cause the...

CVE-2018-1269

CVE-2018-1269 affects Cloud Foundry Loggregator. The issue arises when building certain HTTP requests: errors thrown during construction aren’t handled, which can leave TCP connections dangling. This enables a remote authenticated user to cause denial of service by crafting malicious requests tha...

CVE-2018-1268

Cloud Foundry Loggregator, versions 89.x prior to 89.5 or 96.x prior to 96.1 or 99.x prior to 99.1 or 101.x prior to 101.9 or 102.x prior to 102.2, does not validate app GUID structure in requests. A remote authenticated malicious user knowing the GUID of an app may construct malicious requests t...

CVE-2018-1265

Summary: CVE-2018-1265 affects Cloud Foundry Diego (diego-release before 2.8.0; cf-deployment before v1.37.0). The root cause is improper sanitization/validation of file paths in tar and zip headers, enabling a remote authenticated attacker with CF admin privileges to upload a malicious buildpack...

CVE-2018-1268

Summary: CVE-2018-1268 affects Cloud Foundry Loggregator. The issue is improper validation of app GUID structure in Loggregator requests, allowing a remote authenticated user who knows an app GUID to construct requests to read from or write to that app’s logs. Affected versions include Loggregato...

CVE-2018-1268

Cloud Foundry Loggregator, versions 89.x prior to 89.5 or 96.x prior to 96.1 or 99.x prior to 99.1 or 101.x prior to 101.9 or 102.x prior to 102.2, does not validate app GUID structure in requests. A remote authenticated malicious user knowing the GUID of an app may construct malicious requests t...

CVE-2018-1265

Cloud Foundry Diego, release versions prior to 2.8.0, does not properly sanitize file paths in tar and zip files headers. A remote attacker with CF admin privileges can upload a malicious buildpack that will allow a complete takeover of a Diego Cell VM and access to all apps running on that Diego...

CVE-2018-1269: Improper Handling of Exceptional Conditions

Cloud Foundry Loggregator, versions 89.x prior to 89.5 or 96.x prior to 96.1 or 99.x prior to 99.1 or 101.x prior to 101.9 or 102.x prior to 102.2, does not handle errors thrown while constructing certain http requests. A remote authenticated user may construct malicious requests to cause the...

PT-2018-11306

Name of the Vulnerable Software and Affected Versions Cloud Foundry Diego versions prior to 2.8.0 Description The issue is related to the improper sanitization of file paths in tar and zip files headers. A remote attacker with CF admin privileges can exploit this by uploading a malicious buildpac...

PT-2018-11333

Name of the Vulnerable Software and Affected Versions Cloud Foundry Loggregator versions 89.x prior to 89.5 Cloud Foundry Loggregator versions 96.x prior to 96.1 Cloud Foundry Loggregator versions 99.x prior to 99.1 Cloud Foundry Loggregator versions 101.x prior to 101.9 Cloud Foundry Loggregator...

CVE-2018-1268: Improper Input Validation

Cloud Foundry Loggregator, versions 89.x prior to 89.5 or 96.x prior to 96.1 or 99.x prior to 99.1 or 101.x prior to 101.9 or 102.x prior to 102.2, does not validate app GUID structure in requests. A remote authenticated malicious user knowing the GUID of an app may construct malicious requests t...

PT-2018-11328

Name of the Vulnerable Software and Affected Versions Cloud Foundry Loggregator versions 89.x prior to 89.5 Cloud Foundry Loggregator versions 96.x prior to 96.1 Cloud Foundry Loggregator versions 99.x prior to 99.1 Cloud Foundry Loggregator versions 101.x prior to 101.9 Cloud Foundry Loggregator...

CVE-2018-1265: Unrestricted Upload of File with Dangerous Type

Cloud Foundry Diego, release versions prior to 2.8.0, does not properly sanitize file paths in tar and zip files headers. A remote attacker with CF admin privileges can upload a malicious buildpack that will allow a complete takeover of a Diego Cell VM and access to all apps running on that Diego...