Pivotal Software Cloud Foundry Elastic Runtime vulnerabilities
28 known vulnerabilities affecting pivotal_software/cloud_foundry_elastic_runtime.
Total CVEs
28
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL8HIGH10MEDIUM9LOW1
Vulnerabilities
Page 2 of 2
CVE-2016-4468HIGHCVSS 8.8v1.6.0v1.6.1+34 more2017-04-11
CVE-2016-4468 [HIGH] CWE-89 CVE-2016-4468: SQL injection vulnerability in Pivotal Cloud Foundry (PCF) before 238; UAA 2.x before 2.7.4.4, 3.x b
SQL injection vulnerability in Pivotal Cloud Foundry (PCF) before 238; UAA 2.x before 2.7.4.4, 3.x before 3.3.0.2, and 3.4.x before 3.4.1; UAA BOSH before 11.2 and 12.x before 12.2; Elastic Runtime before 1.6.29 and 1.7.x before 1.7.7; and Ops Manager 1.7.x before 1.7.8 allows remote authenticated users to execute arbitrary SQL commands via unspecified v
nvd
CVE-2016-6657HIGHCVSS 7.4v1.8.0v1.8.1+11 more2016-12-16
CVE-2016-6657 [HIGH] CWE-601 CVE-2016-6657: An open redirect vulnerability has been detected with some Pivotal Cloud Foundry Elastic Runtime com
An open redirect vulnerability has been detected with some Pivotal Cloud Foundry Elastic Runtime components. Users of affected versions should apply the following mitigation: Upgrade PCF Elastic Runtime 1.8.x versions to 1.8.12 or later. Upgrade PCF Ops Manager 1.7.x versions to 1.7.18 or later and 1.8.x versions to 1.8.10 or later.
nvd
CVE-2016-6637CRITICALCVSS 9.6v1.6.0v1.6.1+58 more2016-09-30
CVE-2016-6637 [CRITICAL] CWE-352 CVE-2016-6637: Multiple cross-site request forgery (CSRF) vulnerabilities in Pivotal Cloud Foundry (PCF) before 242
Multiple cross-site request forgery (CSRF) vulnerabilities in Pivotal Cloud Foundry (PCF) before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x before 3.4.4; UAA BOSH before 11.5 and 12.x before 12.5; Elastic Runtime before 1.6.40, 1.7.x before 1.7.21, and 1.8.x before 1.8.2; and Ops Manager 1.7.x before 1.7.13 and 1.8.x before 1.8.1 all
nvd
CVE-2016-6651HIGHCVSS 8.8v1.6.0v1.6.1+58 more2016-09-30
CVE-2016-6651 [HIGH] CWE-264 CVE-2016-6651: The UAA /oauth/token endpoint in Pivotal Cloud Foundry (PCF) before 243; UAA 2.x before 2.7.4.8, 3.x
The UAA /oauth/token endpoint in Pivotal Cloud Foundry (PCF) before 243; UAA 2.x before 2.7.4.8, 3.x before 3.3.0.6, and 3.4.x before 3.4.5; UAA BOSH before 11.7 and 12.x before 12.6; Elastic Runtime before 1.6.40, 1.7.x before 1.7.21, and 1.8.x before 1.8.2; and Ops Manager 1.7.x before 1.7.13 and 1.8.x before 1.8.1 allows remote authenticated users to
nvd
CVE-2016-6636MEDIUMCVSS 5.3v1.6.0v1.6.1+58 more2016-09-30
CVE-2016-6636 [MEDIUM] CWE-601 CVE-2016-6636: The OAuth authorization implementation in Pivotal Cloud Foundry (PCF) before 242; UAA 2.x before 2.7
The OAuth authorization implementation in Pivotal Cloud Foundry (PCF) before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x before 3.4.4; UAA BOSH before 11.5 and 12.x before 12.5; Elastic Runtime before 1.6.40, 1.7.x before 1.7.21, and 1.8.x before 1.8.1; and Ops Manager 1.7.x before 1.7.13 and 1.8.x before 1.8.1 mishandles redirect_uri s
nvd
CVE-2016-0896HIGHCVSS 7.3≤ 1.6.33v1.7.0+11 more2016-09-18
CVE-2016-0896 [HIGH] CWE-254 CVE-2016-0896: Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.34 and 1.7.x before 1.7.12 places 169.254.0.0
Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.34 and 1.7.x before 1.7.12 places 169.254.0.0/16 in the all_open Application Security Group, which might allow remote attackers to bypass intended network-connectivity restrictions by leveraging access to the 169.254.169.254 address.
nvd
CVE-2016-0927MEDIUMCVSS 6.1v1.6.0v1.6.1+14 more2016-09-18
CVE-2016-0927 [MEDIUM] CWE-79 CVE-2016-0927: Cross-site scripting (XSS) vulnerability in Pivotal Cloud Foundry (PCF) Ops Manager before 1.6.17 al
Cross-site scripting (XSS) vulnerability in Pivotal Cloud Foundry (PCF) Ops Manager before 1.6.17 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
nvd
CVE-2016-0926MEDIUMCVSS 6.1≥ 1.6.0, < 1.6.32≥ 1.7.0, < 1.7.82016-09-18
CVE-2016-0926 [MEDIUM] CWE-79 CVE-2016-0926: Cross-site scripting (XSS) vulnerability in Apps Manager in Pivotal Cloud Foundry (PCF) Elastic Runt
Cross-site scripting (XSS) vulnerability in Apps Manager in Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.32 and 1.7.x before 1.7.8 allows remote attackers to inject arbitrary web script or HTML via unspecified input that improperly interacts with the AngularJS framework.
nvd
← Previous2 / 2