CVE-2016-8220

Pivotal Gemfire for PCF, versions 1.6.x prior to 1.6.5.0 and 1.7.x prior to 1.7.1.0, contain an information disclosure vulnerability. The application inadvertently exposed WAN replication credentials at a public route...

CVE-2016-8220

CVE-2016-8220 affects Pivotal GemFire for PCF, specifically versions 1.6.x before 1.6.5.0 and 1.7.x before 1.7.1.0. The vulnerability is an information disclosure where WAN replication credentials are exposed via a public route. The available sources (NVD entry, CVE records) confirm the affected ...

CVE-2016-8220

Pivotal Gemfire for PCF, versions 1.6.x prior to 1.6.5.0 and 1.7.x prior to 1.7.1.0, contain an information disclosure vulnerability. The application inadvertently exposed WAN replication credentials at a public route...

CVE-2016-0898

MySQL for PCF tiles 1.7.x before 1.7.10 were discovered to log the AWS access key in plaintext. These credentials were logged to the Service Backup component logs, and not the system log, thus were not exposed outside the Service Backup VM...

Design/Logic Flaw

MySQL for PCF tiles 1.7.x before 1.7.10 were discovered to log the AWS access key in plaintext. These credentials were logged to the Service Backup component logs, and not the system log, thus were not exposed outside the Service Backup VM...

CVE-2016-0898

CVE-2016-0898 affects MySQL for PCF tiles 1.7.x prior to 1.7.10. The issue is that AWS access keys were logged in plaintext to the Service Backup component logs (not the system logs), within the Service Backup VM. The public disclosures indicate credential leakage via internal logs, not exfiltrat...

CVE-2016-0898

MySQL for PCF tiles 1.7.x before 1.7.10 were discovered to log the AWS access key in plaintext. These credentials were logged to the Service Backup component logs, and not the system log, thus were not exposed outside the Service Backup VM...

Remote file inclusion

Apps Manager for PCF Pivotal Application Service 1.11.x before 1.11.26, 1.12.x before 1.12.14, and 2.0.x before 2.0.5 allows unprivileged remote file read in its container via specially-crafted links...

CVE-2018-1200

Apps Manager for PCF Pivotal Application Service 1.11.x before 1.11.26, 1.12.x before 1.12.14, and 2.0.x before 2.0.5 allows unprivileged remote file read in its container via specially-crafted links...

CVE-2018-1200

Apps Manager for PCF Pivotal Application Service 1.11.x before 1.11.26, 1.12.x before 1.12.14, and 2.0.x before 2.0.5 allows unprivileged remote file read in its container via specially-crafted links...

CVE-2018-1200

CVE-2018-1200 affects the Apps Manager for PCF (Pivotal Application Service) versions 1.11.x before 1.11.26, 1.12.x before 1.12.14, and 2.0.x before 2.0.5. The vulnerability allows an unprivileged attacker to read files from within the Apps Manager container via specially crafted links, resulting...

CVE-2017-13722

In the pcfGetProperties function in bitmap/pcfread.c in libXfont through 1.5.2 and 2.x before 2.0.2, a missing boundary check for PCF files could be used by local attackers authenticated to an Xserver for a buffer over-read, for information disclosure or a crash of the X server...

Cross site scripting

In Pivotal Single Sign-On for PCF 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3, certain pages allow code to be injected into the DOM environment through query parameters, leading to XSS attacks...

CVE-2017-8044

In Pivotal Single Sign-On for PCF 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3, certain pages allow code to be injected into the DOM environment through query parameters, leading to XSS attacks...

CVE-2017-8044

In Pivotal Single Sign-On for PCF 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3, certain pages allow code to be injected into the DOM environment through query parameters, leading to XSS attacks...

CVE-2017-8044

Pivotal Single Sign-On for PCF is affected in versions 1.3.x prior to 1.3.4 and 1.4.x prior to 1.4.3. The vulnerability is a DOM-based XSS where code injected via query parameters can execute in the browser environment. Connected sources corroborate the same vulnerability description across multi...

Design/Logic Flaw

The password change functionality in Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry PCF Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by leveraging failure to expire existing sessions...

Cross site scripting

Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry PCF Elastic Runtime before 1.7.0 allow attackers to have unspecified impact via vectors involving emails with password recovery links, aka "Cross Domain Referer Leakage."...

Cross site request forgery (csrf)

Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry PCF Elastic Runtime before 1.7.0 allow remote attackers to conduct cross-site request forgery CSRF attacks on PWS and log a user into an arbitrary account by leveraging lack of CSRF checks...

CVE-2015-5173

Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry PCF Elastic Runtime before 1.7.0 allow attackers to have unspecified impact via vectors involving emails with password recovery links, aka "Cross Domain Referer Leakage."...