USN-3085-1 GDK-PixBuf vulnerabilities | Cloud Foundry

USN-3085-1 GDK-PixBuf vulnerabilities Medium Vendor Canonical Ubuntu, gdk-pixbuf Versions Affected Canonical Ubuntu 14.04 LTS Description It was discovered that the GDK-PixBuf library did not properly handle specially crafted bmp images, leading to a heap-based buffer overflow. If a user or...

CVE-2016-6637 UAA CSRF Vulnerability for OAuth Approvals | Cloud Foundry

CVE-2016-6637 UAA CSRF Vulnerability for OAuth Approvals Low Vendor Cloud Foundry Foundation Versions Affected Cloud Foundry release v241 and earlier versions UAA release v2.0.0 – v2.7.4.6 & v3.0.0 – v3.6.0 UAA bosh release v15 & earlier versions Description The profile and authorize approval pag...

CVE-2016-6636 UAA Open Redirect Vulnerability for Subdomains | Cloud Foundry

CVE-2016-6636 UAA Open Redirect Vulnerability for Subdomains Medium Vendor Cloud Foundry Foundation Versions Affected Cloud Foundry release v241 and earlier versions UAA release v2.0.0 – v2.7.4.6, v3.0.0 – v3.4.2 UAA BOSH release v12.3 & earlier versions Description Subdomains in the redirecturi...

CVE-2016-6651 Privilege Escalation in UAA | Cloud Foundry

CVE-2016-6651 Privilege Escalation in UAA High Vendor Cloud Foundry Foundation Versions Affected Cloud Foundry release v242 and earlier versions UAA release v3.7.0 & earlier versions UAA bosh release uaa-release v16 & earlier versions Description A privilege escalation vulnerability has been...

CVE-2014-9130: LibYAML vulnerability | Cloud Foundry

CVE-2014-9130: LibYAML vulnerability Medium Vendor LibYAML Versions Affected Cloud Foundry Ruby Buildpack versions prior to 1.6.25 Description Stanisław Pitucha and Jonathan Gray discovered that LibYAML did not properly handle wrapped strings. An attacker could create specially crafted YAML data ...

Pivotal Cloud Foundry Ops Manager Insecure Default Password Vulnerability

Pivotal Cloud Foundry PCF is an open source Platform-as-a-Service PaaS cloud computing platform from Pivotal Software, Inc. that provides container scheduling, continuous delivery, and automated service deployment, etc. PCF Ops Manager is one of the management tools used for deployment, online...

Pivotal Cloud Foundry Elastic Runtime Information Disclosure Vulnerability

Pivotal Cloud Foundry PCF is an open source Platform-as-a-Service PaaS cloud computing platform from Pivotal Software that provides container scheduling, continuous delivery, and automated service deployment.Elastic Runtime is a runtime environment for Pivotal Cloud Foundry. Cloud Foundry PHP...

CVE-2016-6639

Cloud Foundry PHP Buildpack aka php-buildpack before 4.3.18 and PHP Buildpack Cf-release before 242, as used in Pivotal Cloud Foundry PCF Elastic Runtime before 1.6.38 and 1.7.x before 1.7.19 and other products, place the .profile file in the htdocs directory, which might allow remote attackers t...

CVE-2016-6639

Cloud Foundry PHP Buildpack aka php-buildpack before 4.3.18 and PHP Buildpack Cf-release before 242, as used in Pivotal Cloud Foundry PCF Elastic Runtime before 1.6.38 and 1.7.x before 1.7.19 and other products, place the .profile file in the htdocs directory, which might allow remote attackers t...

CVE-2016-0930

Pivotal Cloud Foundry PCF Ops Manager before 1.6.19 and 1.7.x before 1.7.10, when vCloud or vSphere is used, has a default password for compilation VMs, which allows remote attackers to obtain SSH access by connecting within an installation-time period during which these VMs exist...

CVE-2016-0930

Pivotal Cloud Foundry PCF Ops Manager before 1.6.19 and 1.7.x before 1.7.10, when vCloud or vSphere is used, has a default password for compilation VMs, which allows remote attackers to obtain SSH access by connecting within an installation-time period during which these VMs exist...

CVE-2016-0929

The metrics-collection component in RabbitMQ for Pivotal Cloud Foundry PCF 1.6.x before 1.6.4 logs command lines of failed commands, which might allow context-dependent attackers to obtain sensitive information by reading the log data, as demonstrated by a syslog message that contains credentials...

CVE-2016-0929

The metrics-collection component in RabbitMQ for Pivotal Cloud Foundry PCF 1.6.x before 1.6.4 logs command lines of failed commands, which might allow context-dependent attackers to obtain sensitive information by reading the log data, as demonstrated by a syslog message that contains credentials...

CVE-2016-0928

Multiple open redirect vulnerabilities in Pivotal Cloud Foundry PCF Elastic Runtime before 1.6.30 and 1.7.x before 1.7.8 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2016-0928

Multiple open redirect vulnerabilities in Pivotal Cloud Foundry PCF Elastic Runtime before 1.6.30 and 1.7.x before 1.7.8 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2016-0927

Cross-site scripting XSS vulnerability in Pivotal Cloud Foundry PCF Ops Manager before 1.6.17 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-0927

Cross-site scripting XSS vulnerability in Pivotal Cloud Foundry PCF Ops Manager before 1.6.17 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-0926

Cross-site scripting XSS vulnerability in Apps Manager in Pivotal Cloud Foundry PCF Elastic Runtime before 1.6.32 and 1.7.x before 1.7.8 allows remote attackers to inject arbitrary web script or HTML via unspecified input that improperly interacts with the AngularJS framework...

CVE-2016-0926

Cross-site scripting XSS vulnerability in Apps Manager in Pivotal Cloud Foundry PCF Elastic Runtime before 1.6.32 and 1.7.x before 1.7.8 allows remote attackers to inject arbitrary web script or HTML via unspecified input that improperly interacts with the AngularJS framework...

CVE-2016-0897

Pivotal Cloud Foundry PCF Ops Manager before 1.6.17 and 1.7.x before 1.7.8, when vCloud or vSphere is used, does not properly enable SSH access for operators, which has unspecified impact and remote attack vectors...