CVE-2018-1256

Spring Cloud SSO Connector, version 2.1.2, contains a regression which disables issuer validation in resource servers that are not bound to the SSO service. In PCF deployments with multiple SSO service plans, a remote attacker can authenticate to unbound resource servers which use this version of...

Unauthenticated Access

spring-cloud-sso-connector is vulnerable to unauthenticated access. The vulnerability exists due to a regression caused in version 2.1.2, which disables issuer validation in resource servers when PCF is deployed with multiple SSO service plans, allowing malicious users to authenticate to unbound...

Information disclosure

Pivotal Gemfire for PCF, versions 1.6.x prior to 1.6.5.0 and 1.7.x prior to 1.7.1.0, contain an information disclosure vulnerability. The application inadvertently exposed WAN replication credentials at a public route...

CVE-2016-8220

Pivotal Gemfire for PCF, versions 1.6.x prior to 1.6.5.0 and 1.7.x prior to 1.7.1.0, contain an information disclosure vulnerability. The application inadvertently exposed WAN replication credentials at a public route...

CVE-2016-8220

CVE-2016-8220 affects Pivotal GemFire for PCF, specifically versions 1.6.x before 1.6.5.0 and 1.7.x before 1.7.1.0. The vulnerability is an information disclosure where WAN replication credentials are exposed via a public route. The available sources (NVD entry, CVE records) confirm the affected ...

CVE-2016-8220

Pivotal Gemfire for PCF, versions 1.6.x prior to 1.6.5.0 and 1.7.x prior to 1.7.1.0, contain an information disclosure vulnerability. The application inadvertently exposed WAN replication credentials at a public route...

Design/Logic Flaw

MySQL for PCF tiles 1.7.x before 1.7.10 were discovered to log the AWS access key in plaintext. These credentials were logged to the Service Backup component logs, and not the system log, thus were not exposed outside the Service Backup VM...

CVE-2016-0898

MySQL for PCF tiles 1.7.x before 1.7.10 were discovered to log the AWS access key in plaintext. These credentials were logged to the Service Backup component logs, and not the system log, thus were not exposed outside the Service Backup VM...

CVE-2016-0898

CVE-2016-0898 affects MySQL for PCF tiles 1.7.x prior to 1.7.10. The issue is that AWS access keys were logged in plaintext to the Service Backup component logs (not the system logs), within the Service Backup VM. The public disclosures indicate credential leakage via internal logs, not exfiltrat...

CVE-2016-0898

MySQL for PCF tiles 1.7.x before 1.7.10 were discovered to log the AWS access key in plaintext. These credentials were logged to the Service Backup component logs, and not the system log, thus were not exposed outside the Service Backup VM...

Remote file inclusion

Apps Manager for PCF Pivotal Application Service 1.11.x before 1.11.26, 1.12.x before 1.12.14, and 2.0.x before 2.0.5 allows unprivileged remote file read in its container via specially-crafted links...

CVE-2018-1200

Apps Manager for PCF Pivotal Application Service 1.11.x before 1.11.26, 1.12.x before 1.12.14, and 2.0.x before 2.0.5 allows unprivileged remote file read in its container via specially-crafted links...

CVE-2018-1200

Apps Manager for PCF Pivotal Application Service 1.11.x before 1.11.26, 1.12.x before 1.12.14, and 2.0.x before 2.0.5 allows unprivileged remote file read in its container via specially-crafted links...

CVE-2018-1200

CVE-2018-1200 affects the Apps Manager for PCF (Pivotal Application Service) versions 1.11.x before 1.11.26, 1.12.x before 1.12.14, and 2.0.x before 2.0.5. The vulnerability allows an unprivileged attacker to read files from within the Apps Manager container via specially crafted links, resulting...

CVE-2017-13722

In the pcfGetProperties function in bitmap/pcfread.c in libXfont through 1.5.2 and 2.x before 2.0.2, a missing boundary check for PCF files could be used by local attackers authenticated to an Xserver for a buffer over-read, for information disclosure or a crash of the X server...

CVE-2017-8044

In Pivotal Single Sign-On for PCF 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3, certain pages allow code to be injected into the DOM environment through query parameters, leading to XSS attacks...

Cross site scripting

In Pivotal Single Sign-On for PCF 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3, certain pages allow code to be injected into the DOM environment through query parameters, leading to XSS attacks...

CVE-2017-8044

Pivotal Single Sign-On for PCF is affected in versions 1.3.x prior to 1.3.4 and 1.4.x prior to 1.4.3. The vulnerability is a DOM-based XSS where code injected via query parameters can execute in the browser environment. Connected sources corroborate the same vulnerability description across multi...

CVE-2017-8044

In Pivotal Single Sign-On for PCF 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3, certain pages allow code to be injected into the DOM environment through query parameters, leading to XSS attacks...

Cross site scripting

Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry PCF Elastic Runtime before 1.7.0 allow attackers to have unspecified impact via vectors involving emails with password recovery links, aka "Cross Domain Referer Leakage."...