CVSS: 6.6EPSS: 0%CPEs: 3EXPL: 0CVE-2017-8034
https://notcve.org/view.php?id=CVE-2017-8034
17 Jul 2017 — The Cloud Controller and Router in Cloud Foundry (CAPI-release capi versions prior to v1.32.0, Routing-release versions prior to v0.159.0, CF-release versions prior to v267) do not validate the issuer on JSON Web Tokens (JWTs) from UAA. With certain multi-zone UAA configurations, zone administrators are able to escalate their privileges. El controlador y el enrutador de nube en Cloud Foundry (publicación de CAPI versiones de capi anteriores a v1.32.0, publicación de enrutamiento versión anterior a v0.159.0,... • https://www.cloudfoundry.org/cve-2017-8034 • CWE-565: Reliance on Cookies without Validation and Integrity Checking •
CVSS: 9.8EPSS: 0%CPEs: 29EXPL: 0CVE-2016-8218
https://notcve.org/view.php?id=CVE-2016-8218
13 Jun 2017 — An issue was discovered in Cloud Foundry Foundation routing-release versions prior to 0.142.0 and cf-release versions 203 to 231. Incomplete validation logic in JSON Web Token (JWT) libraries can allow unprivileged attackers to impersonate other users to the routing API, aka an "Unauthenticated JWT signing algorithm in routing" issue. Se detectó un problema en routing-release anterior a versión 0.142.0 y cf-release versiones 203 a 231 de Cloud Foundry Foundation. La lógica de comprobación incompleta en las ... • https://www.cloudfoundry.org/cve-2016-8218 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 73EXPL: 0CVE-2017-4992
https://notcve.org/view.php?id=CVE-2017-4992
13 Jun 2017 — An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v261; UAA release 2.x versions prior to v2.7.4.17, 3.6.x versions prior to v3.6.11, 3.9.x versions prior to v3.9.13, and other versions prior to v4.2.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.15, 24.x versions prior to v24.10, 30.x versions prior to 30.3, and other versions prior to v37. There is privilege escalation (arbitrary password reset) with user invitations. Se detectó un problema en cf-release ve... • https://www.cloudfoundry.org/cve-2017-4992 • CWE-269: Improper Privilege Management •
CVSS: 9.8EPSS: 4%CPEs: 2EXPL: 0CVE-2016-6655
https://notcve.org/view.php?id=CVE-2016-6655
13 Jun 2017 — An issue was discovered in Cloud Foundry Foundation Cloud Foundry release versions prior to v245 and cf-mysql-release versions prior to v31. A command injection vulnerability was discovered in a common script used by many Cloud Foundry components. A malicious user may exploit numerous vectors to execute arbitrary commands on servers running Cloud Foundry. Un problema fue descubierto en Cloud Foundry Foundation Cloud Foundry liberado en versiones anteriores a la v245 y cf-mysql liberado anterior a la v31. Un... • http://www.securityfocus.com/bid/93889 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 62EXPL: 0CVE-2017-4972
https://notcve.org/view.php?id=CVE-2017-4972
13 Jun 2017 — An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v257; UAA release 2.x versions prior to v2.7.4.14, 3.6.x versions prior to v3.6.8, 3.9.x versions prior to v3.9.10, and other versions prior to v3.15.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.12, 24.x versions prior to v24.7, and other versions prior to v30. An attacker can use a blind SQL injection attack to query the contents of the UAA database. Se detectó un problema en cf-release versiones anteriores... • https://www.cloudfoundry.org/cve-2017-4972 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 0%CPEs: 64EXPL: 0CVE-2017-4974
https://notcve.org/view.php?id=CVE-2017-4974
13 Jun 2017 — An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v258; UAA release 2.x versions prior to v2.7.4.15, 3.6.x versions prior to v3.6.9, 3.9.x versions prior to v3.9.11, and other versions prior to v3.16.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.13, 24.x versions prior to v24.8, and other versions prior to v30.1. An authorized user can use a blind SQL injection attack to query the contents of the UAA database, aka "Blind SQL Injection with privileged UAA end... • http://www.securityfocus.com/bid/99254 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2016-8219
https://notcve.org/view.php?id=CVE-2016-8219
13 Jun 2017 — An issue was discovered in Cloud Foundry Foundation cf-release versions prior to 250 and CAPI-release versions prior to 1.12.0. A user with the SpaceAuditor role is over-privileged with the ability to restage applications. This could cause application downtime if the restage fails. Se ha descubierto un problema en Cloud Foundry Foundation cf-release en versiones anteriores a 250 y las versiones CAPI-release anteriores a la 1.12.0. Un usuario con el rol SpaceAuditor tiene demasiados privilegios y la capacida... • https://www.cloudfoundry.org/cve-2016-8219 • CWE-269: Improper Privilege Management •
CVSS: 7.2EPSS: 0%CPEs: 66EXPL: 0CVE-2017-4991
https://notcve.org/view.php?id=CVE-2017-4991
13 Jun 2017 — An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v260; UAA release 2.x versions prior to v2.7.4.16, 3.6.x versions prior to v3.6.10, 3.9.x versions prior to v3.9.12, and other versions prior to v3.17.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.14, 24.x versions prior to v24.9, 30.x versions prior to 30.2, and other versions prior to v36. Privileged users in one zone are allowed to perform a password reset for users in a different zone. Se detectó un probl... • https://www.cloudfoundry.org/cve-2017-4991 • CWE-269: Improper Privilege Management •
CVSS: 6.5EPSS: 0%CPEs: 22EXPL: 0CVE-2016-2165
https://notcve.org/view.php?id=CVE-2016-2165
25 May 2017 — The Loggregator Traffic Controller endpoints in cf-release v231 and lower, Pivotal Elastic Runtime versions prior to 1.5.19 AND 1.6.x versions prior to 1.6.20 are not cleansing request URL paths when they are invalid and are returning them in the 404 response. This could allow malicious scripts to be written directly into the 404 response. Los endpoints de Loggregator Traffic Controller en cf-release versiones v231 e inferiores, Pivotal Elastic Runtime anteriores a 1.5.19 y versiones 1.6.x anteriores a 1.6.... • https://pivotal.io/security/cve-2016-2165 • CWE-20: Improper Input Validation •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-4969
https://notcve.org/view.php?id=CVE-2017-4969
20 Apr 2017 — The Cloud Controller in Cloud Foundry cf-release versions prior to v255 allows authenticated developer users to exceed memory and disk quotas for tasks. El Cloud Controller en Cloud Foundry cf-release en versiones anteriores a v255 permiten a los usuarios de desarrolladores autenticados superar las cuotas de memoria y disco para las tareas. • https://www.cloudfoundry.org/cve-2017-4969 •