org.cloudfoundry.identity:cloudfoundry-identity-api (3.4.0), org.cloudfoundry.identity:cloudfoundry-identity-app (3.4.0) +1 more potentially affected by CVE-2016-5016 via org.cloudfoundry.identity:cloudfoundry-identity-server (3.4.0)

org.cloudfoundry.identity:cloudfoundry-identity-server MAVEN version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.cloudfoundry.identity:cloudfoundry-identity-server and may be impacted: - org.cloudfoundry.identity:cloudfoundry-identity-api...

org.cloudfoundry.identity:cloudfoundry-identity-api (>=3.0.0, <=3.3.0.2), org.cloudfoundry.identity:cloudfoundry-identity-app (>=3.0.0, <=3.3.0.2) +1 more potentially affected by CVE-2016-5016 via org.cloudfoundry.identity:cloudfoundry-identity-server (>=3.0.0, <=3.3.0.2)

org.cloudfoundry.identity:cloudfoundry-identity-server MAVEN version =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.3.0.2 Source cves: CVE-2016-5016 Source advisory: MEND:CVE-2016-5016...

Privilege Escalation

CloudFoundry User Account and Authentication UAA is vulnerable to privilege escalation. A malicious user can pass a malicious user token to an unused group endpoint to cause an escalation of privileges...

Blind SQL Injection

CloudFoundry User Account and Authentication UAA is vulnerable to blind SQL injection attacks. The attacks are possible because it does not properly validate the clientid string...

Session Fixation Attacks

CloudFoundry User Account and Authentication UAA is vulnerable to session fixation attacks. These attacks are possible when UAA is configured to authenticate against OpenID Connect or external SAML based identity providers...

Denial Of Service (DoS)

CloudFoundry User Account and Authentication UAA is vulnerable to denial of service DoS attacks. These attacks are possible through the lockout feature...

org.cloudfoundry.identity:cloudfoundry-identity-api (3.10.0), org.cloudfoundry.identity:cloudfoundry-identity-app (3.10.0) +1 more potentially affected by CVE-2017-4960 via org.cloudfoundry.identity:cloudfoundry-identity-server (3.10.0)

org.cloudfoundry.identity:cloudfoundry-identity-server MAVEN version 3.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.cloudfoundry.identity:cloudfoundry-identity-server and may be impacted: - org.cloudfoundry.identity:cloudfoundry-identity-ap...