CVE-2019-11270

Cloud Foundry UAA before v73.4.0 is affected. A malicious client with the clients.write authority can bypass restrictions on clients created via clients.write and create clients with arbitrary scopes the creator does not possess. Affected product: Cloud Foundry UAA (OSS) prior to v73.4.0. Impact:...

CVE-2019-11276

CVE-2019-11276 affects Pivotal Apps Manager (included in Pivotal Application Service versions 2.3.x before 2.3.16, 2.4.x before 2.4.12, 2.5.x before 2.5.8, and 2.6.x before 2.6.3). The vulnerability arises when the application makes a request to the /cloudapplication endpoint via Spring Actuator ...

CVE-2019-3777

Pivotal Application Service (PAS) versions 2.2.x before 2.2.12, 2.3.x before 2.3.7, and 2.4.x before 2.4.3 contain an apps manager that uses a Cloud Controller proxy which fails to verify SSL certificates. A remote unauthenticated attacker could hijack the Cloud Controller’s DNS record to interce...

CVE-2019-3793

CVE-2019-3793 affects Pivotal Apps Manager Release lines 665.0.x <665.0.28, 666.0.x <666.0.21, 667.0.x