CVE-2016-6653: Exposure of Sensitive Information to an Unauthorized Actor

The MariaDB auditplugin component in Pivotal Cloud Foundry PCF cf-mysql-release 27 and 28 allows remote attackers to obtain sensitive information by reading syslog messages, as demonstrated by cleartext credentials...

USN-3095-1 PHP vulnerabilities | Cloud Foundry

USN-3095-1 PHP vulnerabilities Medium Vendor PHP Versions Affected Cloud Foundry PHP buildpack versions prior to 4.3.21 Note: The PHP buildpack is patched from upstream PHP source Description Taoguang Chen discovered that PHP incorrectly handled certain invalid objects when unserializing data. A...

USN-3099-2 Linux kernel vulnerabilities | Cloud Foundry

USN-3099-2 Linux kernel vulnerabilities High Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 LTS Description USN-3099-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04 LTS. This update provides the corresponding updates for the Linux Hardware Enablement HWE kernel from...

CVE-2016-6651

The UAA /oauth/token endpoint in Pivotal Cloud Foundry PCF before 243; UAA 2.x before 2.7.4.8, 3.x before 3.3.0.6, and 3.4.x before 3.4.5; UAA BOSH before 11.7 and 12.x before 12.6; Elastic Runtime before 1.6.40, 1.7.x before 1.7.21, and 1.8.x before 1.8.2; and Ops Manager 1.7.x before 1.7.13 and...

CVE-2016-6651

The UAA /oauth/token endpoint in Pivotal Cloud Foundry PCF before 243; UAA 2.x before 2.7.4.8, 3.x before 3.3.0.6, and 3.4.x before 3.4.5; UAA BOSH before 11.7 and 12.x before 12.6; Elastic Runtime before 1.6.40, 1.7.x before 1.7.21, and 1.8.x before 1.8.2; and Ops Manager 1.7.x before 1.7.13 and...

CVE-2016-6637

Multiple cross-site request forgery CSRF vulnerabilities in Pivotal Cloud Foundry PCF before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x before 3.4.4; UAA BOSH before 11.5 and 12.x before 12.5; Elastic Runtime before 1.6.40, 1.7.x before 1.7.21, and 1.8.x before 1.8.2; and Ops...

CVE-2016-6637

Multiple cross-site request forgery CSRF vulnerabilities in Pivotal Cloud Foundry PCF before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x before 3.4.4; UAA BOSH before 11.5 and 12.x before 12.5; Elastic Runtime before 1.6.40, 1.7.x before 1.7.21, and 1.8.x before 1.8.2; and Ops...

Code injection

The UAA /oauth/token endpoint in Pivotal Cloud Foundry PCF before 243; UAA 2.x before 2.7.4.8, 3.x before 3.3.0.6, and 3.4.x before 3.4.5; UAA BOSH before 11.7 and 12.x before 12.6; Elastic Runtime before 1.6.40, 1.7.x before 1.7.21, and 1.8.x before 1.8.2; and Ops Manager 1.7.x before 1.7.13 and...

Authorization

The OAuth authorization implementation in Pivotal Cloud Foundry PCF before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x before 3.4.4; UAA BOSH before 11.5 and 12.x before 12.5; Elastic Runtime before 1.6.40, 1.7.x before 1.7.21, and 1.8.x before 1.8.1; and Ops Manager 1.7.x before...

CVE-2016-6636

The OAuth authorization implementation in Pivotal Cloud Foundry PCF before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x before 3.4.4; UAA BOSH before 11.5 and 12.x before 12.5; Elastic Runtime before 1.6.40, 1.7.x before 1.7.21, and 1.8.x before 1.8.1; and Ops Manager 1.7.x before...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Pivotal Cloud Foundry PCF before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x before 3.4.4; UAA BOSH before 11.5 and 12.x before 12.5; Elastic Runtime before 1.6.40, 1.7.x before 1.7.21, and 1.8.x before 1.8.2; and Ops...

CVE-2016-6636

The OAuth authorization implementation in Pivotal Cloud Foundry PCF before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x before 3.4.4; UAA BOSH before 11.5 and 12.x before 12.5; Elastic Runtime before 1.6.40, 1.7.x before 1.7.21, and 1.8.x before 1.8.1; and Ops Manager 1.7.x before...

CVE-2016-6636

CVE-2016-6636 affects Pivotal Cloud Foundry components and related UAA releases. The vulnerability arises from improper validation of redirect_uri subdomains in the OAuth authorization flow, enabling a remote attacker to obtain implicit access tokens by using a modified subdomain. Affected softwa...

PT-2016-7012

Name of the Vulnerable Software and Affected Versions Pivotal Cloud Foundry versions prior to 242 UAA versions 2.x prior to 2.7.4.7 UAA versions 3.x prior to 3.3.0.5 UAA versions 3.4.x prior to 3.4.4 UAA BOSH versions prior to 11.5 UAA BOSH versions 12.x prior to 12.5 Elastic Runtime versions 1.6...

CVE-2016-6636: URL Redirection to Untrusted Site

The OAuth authorization implementation in Pivotal Cloud Foundry PCF before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x before 3.4.4; UAA BOSH before 11.5 and 12.x before 12.5; Elastic Runtime before 1.6.40, 1.7.x before 1.7.21, and 1.8.x before 1.8.1; and Ops Manager 1.7.x before...

CVE-2016-6637: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in Pivotal Cloud Foundry PCF before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x before 3.4.4; UAA BOSH before 11.5 and 12.x before 12.5; Elastic Runtime before 1.6.40, 1.7.x before 1.7.21, and 1.8.x before 1.8.2; and Ops...

CVE-2016-6637

CVE-2016-6637 involves multiple CSRF vulnerabilities in Pivotal Cloud Foundry (PCF) and related components. The Cloud Foundry release v241 and earlier, UAA releases v2.0.0–v2.7.4.6 and v3.0.0–v3.6.0, and UAA bosh releases up to v15 are affected. The flaw arises because the profile and authorize a...

PT-2016-7021

Name of the Vulnerable Software and Affected Versions Pivotal Cloud Foundry PCF versions before 243 UAA versions 2.x before 2.7.4.8 UAA versions 3.x before 3.3.0.6 UAA versions 3.4.x before 3.4.5 UAA BOSH versions before 11.7 UAA BOSH versions 12.x before 12.6 Elastic Runtime versions 1.6.x befor...

CVE-2016-6651

CVE-2016-6651 affects the UAA /oauth/token endpoint in Pivotal Cloud Foundry (PCF), including PCF prior to v243 and UAA releases up to specific versions (UAA 2.x before 2.7.4.8, 3.x before 3.3.0.6, 3.4.x before 3.4.5; UAA BOSH before 11.7 and 12.x before 12.6; Elastic Runtime and Ops Manager acro...

CVE-2016-6651: Undefined Security Weakness

The UAA /oauth/token endpoint in Pivotal Cloud Foundry PCF before 243; UAA 2.x before 2.7.4.8, 3.x before 3.3.0.6, and 3.4.x before 3.4.5; UAA BOSH before 11.7 and 12.x before 12.6; Elastic Runtime before 1.6.40, 1.7.x before 1.7.21, and 1.8.x before 1.8.2; and Ops Manager 1.7.x before 1.7.13 and...