CVE-2019-11270: UAA clients.write vulnerability | Cloud Foundry

Severity High Vendor Cloud Foundry Foundation Description Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the ‘clients.write’ authority or scope can bypass the restrictions imposed on clients created via ‘clients.write’ and create clients wi...

USN-4041-1: Linux kernel update | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 16.04 Description USN-4017-1 fixed vulnerabilities in the Linux kernel for Ubuntu. Unfortunately, the update introduced a regression that interfered with networking applications that setup very low SOSNDBUF values. This...

Cloud Foundry UAA Input Validation Error Vulnerability

Cloud Foundry UAA is an authentication and managed service endpoint for the CloudFoundry cloud platform from the Cloud Foundry Foundation in the United States. A security vulnerability exists in Cloud Foundry UAA versions prior to 73.4.0 that stems from the program not setting the X-FRAME-OPTIONS...

CVE-2019-3794

Cloud Foundry UAA, versions prior to v73.4.0, does not set an X-FRAME-OPTIONS header on various endpoints. A remote user can perform clickjacking attacks on UAA's frontend sites...

CVE-2019-3794

Cloud Foundry UAA, versions prior to v73.4.0, does not set an X-FRAME-OPTIONS header on various endpoints. A remote user can perform clickjacking attacks on UAA's frontend sites...

Code injection

Cloud Foundry UAA, versions prior to v73.4.0, does not set an X-FRAME-OPTIONS header on various endpoints. A remote user can perform clickjacking attacks on UAA's frontend sites...

CVE-2019-3794

CVE-2019-3794 affects Cloud Foundry UAA versions prior to 73.4.0, where the X-FRAME-OPTIONS header is not set on multiple endpoints, enabling potential clickjacking of UAA frontend sites. The issue is confirmed across multiple sources (NVD/CNVD/CVELIST entries and Cloud Foundry advisories). Affec...

CVE-2019-3794 UAA - Login app subject to clickjacking attack

Cloud Foundry UAA, versions prior to v73.4.0, does not set an X-FRAME-OPTIONS header on various endpoints. A remote user can perform clickjacking attacks on UAA's frontend sites...

CVE-2019-3800: CF CLI writes the client id and secret to config file | Cloud Foundry

Severity Medium Vendor Cloud Foundry Foundation Affected Cloud Foundry Products and Versions Severity is medium unless otherwise noted. CF CLI All versions prior to v6.45.0 CF CLI Release All versions prior to v1.16.0 CF Networking Release All versions Prior to v2.23.0 CF Routing Release All...

Cloud Foundry Command Line Interface Information Disclosure Vulnerability

Cloud Foundry CLI is a command line client program for Cloud Foundry from the Cloud Foundry Foundation in the United States. An information disclosure vulnerability exists in Cloud Foundry CLI versions prior to v6.43.0. A remote attacker can exploit this vulnerability to obtain some or all user...

Cloud Foundry UAA Authorization Issues Vulnerability

Cloud Foundry UAA is an authentication and managed service endpoint for the CloudFoundry Cloud Platform. An authorization issue vulnerability exists in Cloud Foundry UAA versions prior to v70.0. An attacker could exploit this vulnerability to impersonate another user by changing their address to...

Cloud Foundry UAA Information Disclosure Vulnerability

Cloud Foundry UAA is an authentication and managed service endpoint for the CloudFoundry cloud platform from the Cloud Foundry Foundation in the United States. A security vulnerability exists in Cloud Foundry UAA versions prior to 73.3.0 that stems from the endpoint not being properly escaped. An...

Security Bulletin: A Security Vulnerability affects Cloud Foundry for IBM Cloud Private (CVE-2019-3789)

Summary A security vulnerability affects Cloud Foundry for IBM Cloud Private Vulnerability Details CVEID: CVE-2019-3789 DESCRIPTION: Cloud Foundry Routing Release could allow a remote authenticated attacker to bypass security restrictions, caused by improper authenticity validation of a private...

USN-3977-3: Intel Microcode update (AKA ZombieLoad Attack) | Cloud Foundry

Severity High Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 Canonical Ubuntu 16.04 Description USN-3977-1 and USN-3977-2 provided mitigations for Microarchitectural Data Sampling MDS vulnerabilities in Intel Microcode for a large number of Intel processor families. This update...

CVE-2019-11268

Cloud Foundry UAA version prior to 73.3.0, contain endpoints that contains improper escaping. An authenticated malicious user with basic read privileges for one identity zone can extend those reading privileges to all other identity zones and obtain private information on users, clients, and grou...

CVE-2019-11268

Cloud Foundry UAA version prior to 73.3.0, contain endpoints that contains improper escaping. An authenticated malicious user with basic read privileges for one identity zone can extend those reading privileges to all other identity zones and obtain private information on users, clients, and grou...

Input validation

Cloud Foundry UAA version prior to 73.3.0, contain endpoints that contains improper escaping. An authenticated malicious user with basic read privileges for one identity zone can extend those reading privileges to all other identity zones and obtain private information on users, clients, and grou...

CVE-2019-11268

CVE-2019-11268 affects Cloud Foundry UAA releases prior to 73.3.0. The root cause is endpoints not escaping input, enabling an authenticated user with basic read privileges in one identity zone to extend those privileges to other zones and access private information (users, clients, groups) acros...

CVE-2019-11268 UAA SQL Identity Zone Vulnerability

Cloud Foundry UAA version prior to 73.3.0, contain endpoints that contains improper escaping. An authenticated malicious user with basic read privileges for one identity zone can extend those reading privileges to all other identity zones and obtain private information on users, clients, and grou...

USN-4034-1: ImageMagick vulnerabilities | Cloud Foundry

Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 18.04 Description It was discovered that ImageMagick incorrectly handled certain malformed image files. If a user or automated system using ImageMagick were tricked into opening a specially crafted image, an attacker could...