Pivotal Cloud Foundry Elastic Runtime Security Bypass Vulnerability

Pivotal Cloud Foundry is an open source Platform-as-a-Service PaaS cloud computing platform from Pivotal Software that provides container scheduling, continuous delivery, and automated service deployment.Elastic Runtime is a runtime environment for Pivotal Cloud Foundry. A security bypass...

CVE-2016-5006 Cloud Controller API logs user-provided service credentials | Cloud Foundry

CVE-2016-5006 Cloud Controller API logs user-provided service credentials High Vendor Cloud Foundry Foundation Versions Affected Cloud Foundry releases prior to v239 Description When creating a user-provided service UPS in Cloud Foundry, the Cloud Controller logs the entire UPS object including t...

Multiple Pivotal Product Security Bypass Vulnerabilities

Pivotal Cloud Foundry CF is a suite of open source Platform-as-a-Service PaaS cloud computing platforms from Pivotal Software in the United States, which provides container scheduling, continuous delivery, and automated service deployment. cf-release is a release of CF. Elastic Runtime is CF's...

Pivotal Cloud Foundry Elastic Runtime HTML Injection Vulnerability

Pivotal Cloud Foundry is an open source Platform-as-a-Service PaaS cloud computing platform from Pivotal Software that provides container scheduling, continuous delivery, and automated service deployment.Elastic Runtime is a runtime environment for Pivotal Cloud Foundry. An HTML injection...

Pivotal Cloud Foundry Elastic Runtime Open Redirect Vulnerability

Pivotal Cloud Foundry is an open source Platform-as-a-Service PaaS cloud computing platform from Pivotal Software that provides container scheduling, continuous delivery, and automated service deployment.Elastic Runtime is a runtime environment for Pivotal Cloud Foundry. An open redirection...

Pivotal Software PCF Ops Manager Authorization Issues Vulnerability

Pivotal Software PCF Ops Manager is a set of consoles for installing, upgrading and changing PCFs from Pivotal Software, USA. An authorization issue vulnerability exists in Pivotal Software PCF Ops Manager. A remote attacker could use this vulnerability to bypass the authentication mechanism...

CVE-2016-4450 Nginx Vulnerabilities | Cloud Foundry

CVE-2016-4450 Nginx Vulnerabilities Medium Vendor nginx, Cloud Foundry Versions Affected nginx before 1.10.1 and 1.11.x versions before 1.11.1 Cloud Foundry staticfile buildpack prior to version 1.3.9 Cloud Foundry cf-release prior to version 238 Description os/unix/ngxfiles.c in nginx before...

USN-3012-1 Wget vulnerability | Cloud Foundry

USN-3012-1 Wget vulnerability Medium Vendor Canonical Ubuntu, wget Versions Affected Canonical Ubuntu 14.04 LTS Description Dawid Golunski discovered that Wget incorrectly handled filenames when being redirected from an HTTP to an FTP URL. A malicious server could possibly use this issue to...

USN-3010-1 Expat vulnerabilities | Cloud Foundry

USN-3010-1 Expat vulnerabilities Medium Vendor expat – XML parsing C library, Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 LTS Description It was discovered that Expat unexpectedly called srand in certain circumstances. This could reduce the security of calling applications...

IBM BlueMix Cloud Script Insertion

Document Title: =============== IBM BlueMix Cloud - API Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1846 IBM Security Tracking ID: 5377-12593283 Release Date: ============= 2016-07-04 Vulnerability Laboratory ID VL-ID:...

USN 3020-1 Linux kernel (Vivid HWE) vulnerabilities | Cloud Foundry

USN 3020-1 Linux kernel Vivid HWE vulnerabilities Low – High Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 LTS Description Jesse Hertz and Tim Newsham discovered that the Linux netfilter implementation did not correctly perform validation when handling 32 bit compatibility...

CVE-2016-4468 UAA SQL Injection | Cloud Foundry

High Vendor Cloud Foundry Foundation Versions Affected Cloud Foundry release v237 and earlier versions UAA release v3.4.0 and earlier versions UAA release V12 and earlier versions Description There is the potential for a SQL injection attack in UAA for authenticated users. Mitigation OSS users ar...

USN-3001-1 Linux kernel (Vivid HWE) vulnerabilities | Cloud Foundry

USN-3001-1 Linux kernel Vivid HWE vulnerabilities High Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 LTS Description Justin Yackoski discovered that the Atheros L2 Ethernet Driver in the Linux kernel incorrectly enables scatter/gather I/O. A remote attacker could use this to...

CVE-2016-4435 BOSH Agent Anonymous Endpoint | Cloud Foundry

CVE-2016-4435 BOSH Agent Anonymous Endpoint Medium Vendor Cloud Foundry Foundation Versions Affected BOSH stemcell versions prior to 3232.6 and 3146.13 Description An endpoint of the Agent running on the BOSH Director VM may allow unauthenticated clients to read or write blobs or cause a denial o...

USN-2994-1 libxml2 vulnerabilities | Cloud Foundry

USN-2994-1 libxml2 vulnerabilities Medium Vendor GNOME XML library, Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 LTS Description Multiple researchers discovered that libxml2 incorrectly handled certain malformed documents. If a user or automated system were tricked into opening a...

USN-2987-1 GD library vulnerabilities | Cloud Foundry

USN-2987-1 GD library vulnerabilities Medium Vendor libgd2, Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 LTS Description It was discovered that the GD library incorrectly handled certain color tables in XPM images. If a user or automated system were tricked into processing a speciall...

USN-2961-1 Little CMS vulnerability | Cloud Foundry

USN-2961-1 Little CMS vulnerability Medium Vendor Little CMS, Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 LTS Description It was discovered that a double free could occur when the intent handling code in the Little CMS library detected an error. An attacker could use this to special...

USN-2990-1 ImageMagick vulnerability (a.k.a. ImageTragick) | Cloud Foundry

USN-2990-1 ImageMagick vulnerability a.k.a. ImageTragick Medium Vendor Imagemagick, Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 LTS Description Nikolay Ermishkin and Stewie discovered that ImageMagick incorrectly sanitized untrusted input. A remote attacker could use these issues to...

USN-2966-1 OpenSSH vulnerabilities | Cloud Foundry

USN-2966-1 OpenSSH vulnerabilities Low Vendor Canonical Ubuntu, openssh Versions Affected Canonical Ubuntu 14.04 LTS Description Shayan Sadigh discovered that OpenSSH incorrectly handled environment files when the UseLogin feature is enabled. A local attacker could use this issue to gain...

USN-2983-1 Expat vulnerability | Cloud Foundry

USN-2983-1 Expat vulnerability Medium Vendor Expat, Canonical Ubuntu Versions Affected Canonical Ubuntu 14.04 LTS Description Gustavo Grieco discovered that Expat incorrectly handled malformed XML data. If a user or application linked against Expat were tricked into opening a crafted XML file, an...