PT-2016-4481

Name of the Vulnerable Software and Affected Versions Pivotal Cloud Foundry PCF Elastic Runtime versions 1.6.0 through 1.6.29 Pivotal Cloud Foundry PCF Elastic Runtime versions 1.7.0 through 1.7.7 Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct...

PT-2016-4442

Name of the Vulnerable Software and Affected Versions Pivotal Cloud Foundry PCF Ops Manager versions prior to 1.5.14 Pivotal Cloud Foundry PCF Ops Manager versions 1.6.x prior to 1.6.9 Description The issue allows remote attackers to bypass session authentication by leveraging knowledge of the...

CVE-2016-0929: Exposure of Sensitive Information to an Unauthorized Actor

The metrics-collection component in RabbitMQ for Pivotal Cloud Foundry PCF 1.6.x before 1.6.4 logs command lines of failed commands, which might allow context-dependent attackers to obtain sensitive information by reading the log data, as demonstrated by a syslog message that contains credentials...

CVE-2016-0896: Undefined Security Weakness

Pivotal Cloud Foundry PCF Elastic Runtime before 1.6.34 and 1.7.x before 1.7.12 places 169.254.0.0/16 in the allopen Application Security Group, which might allow remote attackers to bypass intended network-connectivity restrictions by leveraging access to the 169.254.169.254 address...

CVE-2016-0928: URL Redirection to Untrusted Site

Multiple open redirect vulnerabilities in Pivotal Cloud Foundry PCF Elastic Runtime before 1.6.30 and 1.7.x before 1.7.8 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

PT-2016-7013

Name of the Vulnerable Software and Affected Versions Cloud Foundry PHP Buildpack versions prior to 4.3.18 PHP Buildpack Cf-release versions prior to 242 Pivotal Cloud Foundry PCF Elastic Runtime versions prior to 1.6.38 Pivotal Cloud Foundry PCF Elastic Runtime versions 1.7.x prior to 1.7.19...

PT-2016-4479

Name of the Vulnerable Software and Affected Versions Pivotal Cloud Foundry PCF Elastic Runtime versions 1.6.0 through 1.6.32 Pivotal Cloud Foundry PCF Elastic Runtime versions 1.7.0 through 1.7.8 Description The issue is related to a cross-site scripting XSS vulnerability in the Apps Manager...

CVE-2016-0897: Undefined Security Weakness

Pivotal Cloud Foundry PCF Ops Manager before 1.6.17 and 1.7.x before 1.7.8, when vCloud or vSphere is used, does not properly enable SSH access for operators, which has unspecified impact and remote attack vectors...

CVE-2016-0883: Improper Authentication

Pivotal Cloud Foundry PCF Ops Manager before 1.5.14 and 1.6.x before 1.6.9 uses the same cookie-encryption key across different customers' installations, which allows remote attackers to bypass session authentication by leveraging knowledge of this key from another installation...

PT-2016-4452

Name of the Vulnerable Software and Affected Versions Pivotal Cloud Foundry PCF Ops Manager versions 1.6.x through 1.6.16 Pivotal Cloud Foundry PCF Ops Manager versions 1.7.x through 1.7.7 Description The issue affects Pivotal Cloud Foundry PCF Ops Manager when used with vCloud or vSphere, and it...

CVE-2016-0926: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Apps Manager in Pivotal Cloud Foundry PCF Elastic Runtime before 1.6.32 and 1.7.x before 1.7.8 allows remote attackers to inject arbitrary web script or HTML via unspecified input that improperly interacts with the AngularJS framework...

PT-2016-4480

Name of the Vulnerable Software and Affected Versions Pivotal Cloud Foundry PCF Ops Manager versions prior to 1.6.17 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Recommendations For versions prior to 1.6.17,...

CVE-2016-0927: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Pivotal Cloud Foundry PCF Ops Manager before 1.6.17 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2016-4482

Name of the Vulnerable Software and Affected Versions RabbitMQ for Pivotal Cloud Foundry PCF versions 1.6.x through 1.6.3 Description The issue allows context-dependent attackers to obtain sensitive information by reading the log data. This is because the metrics-collection component logs command...

USN-3045-1 PHP vulnerabilities | Cloud Foundry

USN-3045-1 PHP vulnerabilities Medium Vendor PHP Versions Affected Cloud Foundry PHP buildpack versions prior to 4.3.18 Note: The PHP buildpack is patched from upstream PHP source Description It was discovered that PHP incorrectly handled certain SplMinHeap::compare operations. A remote attacker...

CVE-2016-6639: PHP Buildpack exposes .profile file | Cloud Foundry

CVE-2016-6639: PHP Buildpack exposes .profile file Medium Vendor Cloud Foundry Foundation Versions Affected PHP Buildpack versions prior to v4.3.18 Cf-release versions prior to v242 Description The .profile file, which can potentially include environment variables and credentials, is exposed by...

USN-3065-1 Libgcrypt vulnerability | Cloud Foundry

USN-3065-1 Libgcrypt vulnerability High Vendor Canonical Ubuntu, libgcrypt Versions Affected Canonical Ubuntu 14.04 LTS Description Felix Dörre and Vladimir Klebanov discovered that Libgcrypt incorrectly handled mixing functions in the random number generator. An attacker able to obtain 4640 bits...

USN-3053-1/USN-3037-1 Linux kernel (Vivid HWE) vulnerability | Cloud Foundry

USN-3053-1/USN-3037-1 Linux kernel Vivid HWE vulnerability Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 LTS Description A missing permission check when settings ACLs was discovered in nfsd. A local user could exploit this flaw to gain access to any file by setting an AC...

USN-3048-1 curl vulnerability | Cloud Foundry

USN-3048-1 curl vulnerability Medium Vendor Canonical Ubuntu, curl Versions Affected Canonical Ubuntu 14.04 LTS Description Bru Rom discovered that curl incorrectly handled client certificates when resuming a TLS session. CVE-2016-5419 It was discovered that curl incorrectly handled client...

USN-3064-1 GnuPG vulnerability | Cloud Foundry

USN-3064-1 GnuPG vulnerability High Vendor Canonical Ubuntu, gnupg Versions Affected Canonical Ubuntu 14.04 LTS Description Felix Dörre and Vladimir Klebanov discovered that GnuPG incorrectly handled mixing functions in the random number generator. An attacker able to obtain 4640 bits from the RN...