EUVD-2025-14361

Malicious code in bioql PyPI...

EUVD-2022-4331

Malicious code in bioql PyPI...

EUVD-2021-9259

Malicious code in bioql PyPI...

CVE-2023-20903

This disclosure regards a vulnerability related to UAA refresh tokens and external identity providers.Assuming that an external identity provider is linked to the UAA, a refresh token is issued to a client on behalf of a user from that identity provider, the administrator of the UAA deactivates t...

CVE-2025-22246

Cloud Foundry UAA release versions from v77.21.0 to v7.31.0 are vulnerable to a private key exposure in logs...

CVE-2025-22246

Cloud Foundry UAA release versions from v77.21.0 to v7.31.0 are vulnerable to a private key exposure in logs...

CVE-2025-22246

CVE-2025-22246 affects Cloud Foundry UAA releases from 77.21.0 up to 77.31.0 (and CF deployment 45.1.0 to 48.11.0) with a private key exposure in logs. Root cause and exact vulnerability mechanics are described in the Cloud Foundry advisory: upgrading UAA to 77.32.0+ and CF deployment to 49.0.0+ ...

CVE-2025-22246 CVE-2025-22246 – UAA Private Key Exposure

Cloud Foundry UAA release versions from v77.21.0 to v7.31.0 are vulnerable to a private key exposure in logs...

CVE-2025-22246 CVE-2025-22246 – UAA Private Key Exposure

Cloud Foundry UAA release versions from v77.21.0 to v7.31.0 are vulnerable to a private key exposure in logs...

CVE-2025-22246 CVE-2025-22246 – UAA Private Key Exposure

Cloud Foundry UAA release versions from v77.21.0 to v7.31.0 are vulnerable to a private key exposure in logs...

PT-2025-20827 · Cloud Foundry · Cloud Foundry Uaa

Name of the Vulnerable Software and Affected Versions: Cloud Foundry UAA versions 77.21.0 through 7.31.0 Description: The issue concerns a private key exposure in logs. Recommendations: For versions 77.21.0 through 7.31.0, update to a version that fixes the private key exposure issue...

CVE-2025-22246 - UAA Private Key Exposure | Cloud Foundry

Severity LOW Vendor CloudFoundry Foundation Versions Affected UAA Release: v77.21.0 to v77.31.0 CF Deployment: v45.1.0 to v48.11.0 Description Cloud Foundry UAA release versions from v77.21.0 to v7.31.0 are vulnerable to a private key exposure in logs. Affected Cloud Foundry Products and Versions...

CVE-2025-22216 CVE-2025-22216 UAA Missing Zone Validation

A UAA configured with multiple identity zones, does not properly validate session information across those zones. A User authenticated against a corporate IDP can re-use their jsessionid to access other zones...

CVE-2025-22216

CVE-2025-22216 affects CloudFoundry UAA (multi-identity-zone configuration). The issue is improper validation of session information across zones, allowing a user authenticated against a corporate IDP to reuse a jsessionid to access other zones. Affected releases include UAA up to 77.20.1, 77.24....

CVE-2025-22216 CVE-2025-22216 UAA Missing Zone Validation

A UAA configured with multiple identity zones, does not properly validate session information across those zones. A User authenticated against a corporate IDP can re-use their jsessionid to access other zones...

CVE-2025-22216 - UAA Missing Zone Validation | Cloud Foundry

Severity MED Overall CVSS Score: 5.0 CVSS v3.1 Vector: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C Vendor CloudFoundry Foundation Versions Affected Affected thru UAA Releases 77.20.1, 77.24.0 including 77.21.0, 77.22.0, 77.23.0 Unaffected from UAA Release 77.20.2 Unaffected from UAA Release...

africa.absa:inception-oauth2-resource-server (>=1.0.0 <=1.2.0), ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0 <=4.6.0.0) +7367 more potentially affected by CVE-2024-38821 via org.springframework.security:spring-security-web (>=3.0.0.RELEASE <=5.7.12)

org.springframework.security:spring-security-web MAVEN version =3.0.0.RELEASE, =1.0.0, =4.4.0.0, =0.1.8, =0.1.6, =0.1.2, =0.5.0, =j8.2.4.0, =j8.2.4.0, =1.0.0, =1.0.0, =1.0.0, =0.0.2, =0.0.3, =1.1.0.RELEASE, =0.3, =0.6 and more Source cves: CVE-2024-38821 Source advisory: OSV:GHSA-C4Q5-6C82-3QPW...

CVE-2024-38806 UAA Failure to Remove Shadow User’s Access

Failure to properly synchronize user's permissions in UAA in Cloud Foundry Foundation v40.17.0 https://github.com/cloudfoundry/cf-deployment/releases/tag/v40.17.0 , potentially resulting in users retaining access rights they should not have. This can allow them to perform operations beyond their...

CVE-2024-38806

CVE-2024-38806 concerns a permission-synchronization flaw in Cloud Foundry Foundation’s UAA for version v40.17.0, where shadow/ stale group mappings can leave users with outdated access rights. Technical details from connected sources show the issue arises when UAA proxies external provider group...

CVE-2024-38806 UAA Failure to Remove Shadow User’s Access

Failure to properly synchronize user's permissions in UAA in Cloud Foundry Foundation v40.17.0 https://github.com/cloudfoundry/cf-deployment/releases/tag/v40.17.0 , potentially resulting in users retaining access rights they should not have. This can allow them to perform operations beyond their...