PT-2016-4483

Name of the Vulnerable Software and Affected Versions Pivotal Cloud Foundry PCF Ops Manager versions 1.6.0 through 1.6.18 Pivotal Cloud Foundry PCF Ops Manager versions 1.7.0 through 1.7.9 Description The issue allows remote attackers to obtain SSH access to compilation VMs by connecting within a...

CVE-2016-0897: Undefined Security Weakness

Pivotal Cloud Foundry PCF Ops Manager before 1.6.17 and 1.7.x before 1.7.8, when vCloud or vSphere is used, does not properly enable SSH access for operators, which has unspecified impact and remote attack vectors...

CVE-2016-0930: Concurrent Execution using Shared Resource with Improper Synchronization

Pivotal Cloud Foundry PCF Ops Manager before 1.6.19 and 1.7.x before 1.7.10, when vCloud or vSphere is used, has a default password for compilation VMs, which allows remote attackers to obtain SSH access by connecting within an installation-time period during which these VMs exist...

PT-2016-4481

Name of the Vulnerable Software and Affected Versions Pivotal Cloud Foundry PCF Elastic Runtime versions 1.6.0 through 1.6.29 Pivotal Cloud Foundry PCF Elastic Runtime versions 1.7.0 through 1.7.7 Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct...

PT-2016-4442

Name of the Vulnerable Software and Affected Versions Pivotal Cloud Foundry PCF Ops Manager versions prior to 1.5.14 Pivotal Cloud Foundry PCF Ops Manager versions 1.6.x prior to 1.6.9 Description The issue allows remote attackers to bypass session authentication by leveraging knowledge of the...

CVE-2016-0929: Exposure of Sensitive Information to an Unauthorized Actor

The metrics-collection component in RabbitMQ for Pivotal Cloud Foundry PCF 1.6.x before 1.6.4 logs command lines of failed commands, which might allow context-dependent attackers to obtain sensitive information by reading the log data, as demonstrated by a syslog message that contains credentials...

CVE-2016-0896: Undefined Security Weakness

Pivotal Cloud Foundry PCF Elastic Runtime before 1.6.34 and 1.7.x before 1.7.12 places 169.254.0.0/16 in the allopen Application Security Group, which might allow remote attackers to bypass intended network-connectivity restrictions by leveraging access to the 169.254.169.254 address...

CVE-2016-0928: URL Redirection to Untrusted Site

Multiple open redirect vulnerabilities in Pivotal Cloud Foundry PCF Elastic Runtime before 1.6.30 and 1.7.x before 1.7.8 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

PT-2016-7013

Name of the Vulnerable Software and Affected Versions Cloud Foundry PHP Buildpack versions prior to 4.3.18 PHP Buildpack Cf-release versions prior to 242 Pivotal Cloud Foundry PCF Elastic Runtime versions prior to 1.6.38 Pivotal Cloud Foundry PCF Elastic Runtime versions 1.7.x prior to 1.7.19...

PT-2016-4452

Name of the Vulnerable Software and Affected Versions Pivotal Cloud Foundry PCF Ops Manager versions 1.6.x through 1.6.16 Pivotal Cloud Foundry PCF Ops Manager versions 1.7.x through 1.7.7 Description The issue affects Pivotal Cloud Foundry PCF Ops Manager when used with vCloud or vSphere, and it...

CVE-2016-0926: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Apps Manager in Pivotal Cloud Foundry PCF Elastic Runtime before 1.6.32 and 1.7.x before 1.7.8 allows remote attackers to inject arbitrary web script or HTML via unspecified input that improperly interacts with the AngularJS framework...

PT-2016-4479

Name of the Vulnerable Software and Affected Versions Pivotal Cloud Foundry PCF Elastic Runtime versions 1.6.0 through 1.6.32 Pivotal Cloud Foundry PCF Elastic Runtime versions 1.7.0 through 1.7.8 Description The issue is related to a cross-site scripting XSS vulnerability in the Apps Manager...

CVE-2016-0883: Improper Authentication

Pivotal Cloud Foundry PCF Ops Manager before 1.5.14 and 1.6.x before 1.6.9 uses the same cookie-encryption key across different customers' installations, which allows remote attackers to bypass session authentication by leveraging knowledge of this key from another installation...

PT-2016-4480

Name of the Vulnerable Software and Affected Versions Pivotal Cloud Foundry PCF Ops Manager versions prior to 1.6.17 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Recommendations For versions prior to 1.6.17,...

CVE-2016-6639: PHP Buildpack exposes .profile file | Cloud Foundry

CVE-2016-6639: PHP Buildpack exposes .profile file Medium Vendor Cloud Foundry Foundation Versions Affected PHP Buildpack versions prior to v4.3.18 Cf-release versions prior to v242 Description The .profile file, which can potentially include environment variables and credentials, is exposed by...

USN-3045-1 PHP vulnerabilities | Cloud Foundry

USN-3045-1 PHP vulnerabilities Medium Vendor PHP Versions Affected Cloud Foundry PHP buildpack versions prior to 4.3.18 Note: The PHP buildpack is patched from upstream PHP source Description It was discovered that PHP incorrectly handled certain SplMinHeap::compare operations. A remote attacker...

USN-3053-1/USN-3037-1 Linux kernel (Vivid HWE) vulnerability | Cloud Foundry

USN-3053-1/USN-3037-1 Linux kernel Vivid HWE vulnerability Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 LTS Description A missing permission check when settings ACLs was discovered in nfsd. A local user could exploit this flaw to gain access to any file by setting an AC...

USN-3065-1 Libgcrypt vulnerability | Cloud Foundry

USN-3065-1 Libgcrypt vulnerability High Vendor Canonical Ubuntu, libgcrypt Versions Affected Canonical Ubuntu 14.04 LTS Description Felix Dörre and Vladimir Klebanov discovered that Libgcrypt incorrectly handled mixing functions in the random number generator. An attacker able to obtain 4640 bits...

USN-3064-1 GnuPG vulnerability | Cloud Foundry

USN-3064-1 GnuPG vulnerability High Vendor Canonical Ubuntu, gnupg Versions Affected Canonical Ubuntu 14.04 LTS Description Felix Dörre and Vladimir Klebanov discovered that GnuPG incorrectly handled mixing functions in the random number generator. An attacker able to obtain 4640 bits from the RN...

USN-3063-1 Fontconfig vulnerability | Cloud Foundry

USN-3063-1 Fontconfig vulnerability Medium Vendor Canonical Ubuntu, fontconfig Versions Affected Canonical Ubuntu 14.04 LTS Description Tobias Stoeckmann discovered that Fontconfig incorrectly handled cache files. A local attacker could possibly use this issue with a specially crafted cache file ...