CVSS: 7.2EPSS: 0%CPEs: 66EXPL: 0CVE-2017-4991
https://notcve.org/view.php?id=CVE-2017-4991
An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v260; UAA release 2.x versions prior to v2.7.4.16, 3.6.x versions prior to v3.6.10, 3.9.x versions prior to v3.9.12, and other versions prior to v3.17.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.14, 24.x versions prior to v24.9, 30.x versions prior to 30.2, and other versions prior to v36. Privileged users in one zone are allowed to perform a password reset for users in a different zone. Se detectó un problema en cf-release versiones anteriores a 260; UAA release versiones 2.x anteriores a 2.7.4.16, versiones 3.6.x anteriores a 3.6.10, versiones 3.9.x anteriores a 3.9.12, y otras versiones anteriores a 3.17.0; y UAA bosh release (uaa-release) versiones 13.x anteriores a 13.14, versiones 24.x anteriores a 24.9, versiones 30.x anterior a 30.2, y otras versiones anteriores a 36 de Cloud Foundry Foundation. Los usuarios con privilegios de una zona pueden realizar un restablecimiento de contraseña por los usuarios de una zona diferente. • https://www.cloudfoundry.org/cve-2017-4991 • CWE-269: Improper Privilege Management •
CVSS: 8.8EPSS: 0%CPEs: 36EXPL: 0CVE-2017-4959
https://notcve.org/view.php?id=CVE-2017-4959
An issue was discovered in Pivotal PCF Elastic Runtime 1.8.x versions prior to 1.8.29 and 1.9.x versions prior to 1.9.7. Pivotal Cloud Foundry deployments using the Pivotal Account application are vulnerable to a flaw which allows an authorized user to take over the account of another user, causing account lockout and potential escalation of privileges. Se ha descubierto un problema en Pivotal PCF Elastic Runtime, en versiones 1.8.x anteriores a la 1.8.29 y en versiones 1.9.x anteriores a la 1.9.7. Los despliegues de Pivotal Cloud Foundry que emplean la aplicación Pivotal Account son vulnerables a un error que permite que un usuario autorizado tome el control de la cuenta de otro usuario, lo que podría provocar el bloqueo de la cuenta y un potencial escalado de privilegios. • http://www.securityfocus.com/bid/96218 https://pivotal.io/security/cve-2017-4959 •
CVSS: 9.8EPSS: 0%CPEs: 143EXPL: 0CVE-2017-4955
https://notcve.org/view.php?id=CVE-2017-4955
An issue was discovered in Pivotal PCF Elastic Runtime 1.6.x versions prior to 1.6.65, 1.7.x versions prior to 1.7.48, 1.8.x versions prior to 1.8.28, and 1.9.x versions prior to 1.9.5. Several credentials were present in the logs for the Notifications errand in the PCF Elastic Runtime tile. Se detectó un problema en las versiones de PCF Elastic Runtime de Pivotal versiones 1.6.x anteriores a 1.6.65, versiones 1.7.x anteriores a 1.7.48, versiones 1.8.x anteriores a 1.8.28 y versiones 1.9.x anteriores a 1.9.5. Varias credenciales estaban presentes en los registros para la tarea Notifications en el mosaico de PCF Elastic Runtime. • http://www.securityfocus.com/bid/97082 https://pivotal.io/security/cve-2017-4955 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 6.1EPSS: 0%CPEs: 69EXPL: 0CVE-2017-4967
https://notcve.org/view.php?id=CVE-2017-4967
An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions, all 3.5.x versions, and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions, 1.6.x versions prior to 1.6.18, and 1.7.x versions prior to 1.7.15. Several forms in the RabbitMQ management UI are vulnerable to XSS attacks. Se detectó un problema en estas versiones de RabbitMQ de Pivotal: todas las versiones 3.4.x, todas las versiones 3.5.x y versiones 3.6.x anteriores a 3.6.9; y en estas versiones de RabbitMQ de Pivotal para PCF: todas las versiones 1.5.x, versiones 1.6.x anteriores a 1.6.18 y versiones 1.7.x anteriores a 1.7.15. Varios formularios en la interfaz de usuario de administración de RabbitMQ son vulnerables a los ataques de tipo XSS. • https://lists.debian.org/debian-lts-announce/2021/07/msg00011.html https://pivotal.io/security/cve-2017-4965 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 123EXPL: 0CVE-2017-2773
https://notcve.org/view.php?id=CVE-2017-2773
An issue was discovered in Pivotal PCF Elastic Runtime 1.6.x versions prior to 1.6.60, 1.7.x versions prior to 1.7.41, 1.8.x versions prior to 1.8.23, and 1.9.x versions prior to 1.9.1. Incomplete validation logic in JSON Web Token (JWT) libraries can allow unprivileged attackers to impersonate other users in multiple components included in PCF Elastic Runtime, aka an "Unauthenticated JWT signing algorithm in multiple components" issue. Se ha descubierto un problema en Pivotal PCF Elastic Runtime en versiones 1.6.x anteriores a la 1.6.60, versiones 1.7.x anteriores a la 1.7.41, versiones 1.8.x anteriores a la 1.8.23 y versiones 1.9.x anteriores a la 1.9.1. La lógica de validación incompleta en las bibliotecas JSON Web Token (JWT) puede permitir que atacantes no privilegiados suplanten a otros usuarios en múltiples componentes incluidos en PCF Elastic Runtime. Esto también se conoce como problema "Unauthenticated JWT signing algorithm in multiple components". • http://www.securityfocus.com/bid/97135 https://pivotal.io/security/cve-2017-2773 • CWE-20: Improper Input Validation •