CVE-2019-11281 RabbitMQ XSS attack

Pivotal RabbitMQ, versions prior to v3.7.18, and RabbitMQ for PCF, versions 1.15.x prior to 1.15.13, versions 1.16.x prior to 1.16.6, and versions 1.17.x prior to 1.17.3, contain two components, the virtual host limits page, and the federation management UI, which do not properly sanitize user...

CVE-2019-11281

CVE-2019-11281 affects Pivotal RabbitMQ and RabbitMQ for PCF where two UI components (virtual host limits page and federation management UI) fail to sanitize user input. A remote authenticated administrator could craft a cross-site scripting attack to access virtual hosts and policy management in...

CVE-2019-11281

Pivotal RabbitMQ, versions prior to v3.7.18, and RabbitMQ for PCF, versions 1.15.x prior to 1.15.13, versions 1.16.x prior to 1.16.6, and versions 1.17.x prior to 1.17.3, contain two components, the virtual host limits page, and the federation management UI, which do not properly sanitize user...

freetype2:glyphs-bitmaps-pcf: Heap-buffer-overflow in triplet_decode

Detailed Report: https://oss-fuzz.com/testcase?key=5687246878932992 Project: freetype2 Fuzzing Engine: libFuzzer Fuzz Target: glyphs-bitmaps-pcf Job Type: libfuzzerasanfreetype2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x61d00000096f Crash State: tripletdecode...

CVE-2019-4378

IBM MQ 7.5.0.0 - 7.5.0.9, 7.1.0.0 - 7.1.0.9, 8.0.0.0 - 8.0.0.12, 9.0.0.0 - 9.0.0.6, 9.1.0.0 - 9.1.0.2, and 9.1.0 - 9.1.2 command server is vulnerable to a denial of service attack caused by an authenticated and authorized user using specially crafted PCF messages. IBM X-Force ID: 162084...

VMSA-2019-0015:VMware Cloud Foundation and VMware Harbor Container Registry for PCF address remote escalation of privilege vulnerability

VMware Security Advisories Advisory ID| VMSA-2019-0015 ---|--- Advisory Severity| Critical CVSSv3 Range| 9.8 Synopsis| VMware Cloud Foundation and VMware Harbor Container Registry for PCF address remote escalation of privilege vulnerability CVE-2019-16097 Issue Date| 2019-09-24 Updated On|...

Security Bulletin: IBM MQ and IBM MQ Appliance command server is vulnerable to a denial of service attack caused by specially crafted PCF messages (CVE-2019-4378)

Summary An error was found within the IBM MQ and IBM MQ Appliance Command Server PCF logic that means an attacker can cause a denial of service attack by sending a specially crafted PCF message. Doing so will cause the Command Server to crash, which will prevent further administrative commands fr...

CVE-2018-1279

Pivotal RabbitMQ for PCF, all versions, uses a deterministically generated cookie that is shared between all machines when configured in a multi-tenant cluster. A remote attacker who can gain information about the network topology can guess this cookie and, if they have access to the right ports ...

Code injection

Pivotal RabbitMQ for PCF, all versions, uses a deterministically generated cookie that is shared between all machines when configured in a multi-tenant cluster. A remote attacker who can gain information about the network topology can guess this cookie and, if they have access to the right ports ...

CVE-2018-1279

CVE-2018-1279 affects Pivotal RabbitMQ for PCF, all versions. The root cause is a deterministically generated authentication cookie that is shared across all nodes in a multi-tenant cluster. A remote attacker who can glean information about the network topology can guess this cookie and, if they ...

CVE-2018-1279 RabbitMQ cluster compromise due to deterministically generated cookie

Pivotal RabbitMQ for PCF, all versions, uses a deterministically generated cookie that is shared between all machines when configured in a multi-tenant cluster. A remote attacker who can gain information about the network topology can guess this cookie and, if they have access to the right ports ...

CVE-2018-1279

Pivotal RabbitMQ for PCF, all versions, uses a deterministically generated cookie that is shared between all machines when configured in a multi-tenant cluster. A remote attacker who can gain information about the network topology can guess this cookie and, if they have access to the right ports ...

pcf-projekt.de XSS vulnerability

Open Bug Bounty ID: OBB-683839 Description| Value ---|--- Affected Website:| pcf-projekt.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

freetype2/ftfuzzer: Heap-buffer-overflow in pcf_get_encodings

Detailed report: https://oss-fuzz.com/testcase?key=6409167655927808 Project: freetype2 Fuzzer: libFuzzerfreetype2ftfuzzer Fuzz target binary: ftfuzzer Job Type: libfuzzerasanfreetype2 Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x60500000340f Crash State:...

CVE-2018-1256

Spring Cloud SSO Connector, version 2.1.2, contains a regression which disables issuer validation in resource servers that are not bound to the SSO service. In PCF deployments with multiple SSO service plans, a remote attacker can authenticate to unbound resource servers which use this version of...

CVE-2018-1256

Spring Cloud SSO Connector, version 2.1.2, contains a regression which disables issuer validation in resource servers that are not bound to the SSO service. In PCF deployments with multiple SSO service plans, a remote attacker can authenticate to unbound resource servers which use this version of...

CVE-2018-1256

Spring Cloud SSO Connector, version 2.1.2, contains a regression which disables issuer validation in resource servers that are not bound to the SSO service. In PCF deployments with multiple SSO service plans, a remote attacker can authenticate to unbound resource servers which use this version of...

CVE-2018-1256

CVE-2018-1256 relates to Spring Cloud SSO Connector 2.1.2, where a regression disables issuer validation in resource servers not bound to the SSO service. In PCF environments with multiple SSO service plans, an attacker could authenticate against unbound resource servers using tokens from another...

Unauthenticated Access

spring-cloud-sso-connector is vulnerable to unauthenticated access. The vulnerability exists due to a regression caused in version 2.1.2, which disables issuer validation in resource servers when PCF is deployed with multiple SSO service plans, allowing malicious users to authenticate to unbound...

Information disclosure

Pivotal Gemfire for PCF, versions 1.6.x prior to 1.6.5.0 and 1.7.x prior to 1.7.1.0, contain an information disclosure vulnerability. The application inadvertently exposed WAN replication credentials at a public route...