Page 3 of 28 results (0.005 seconds)

CVSS: 5.3EPSS: 0%CPEs: 97EXPL: 0

CVE-2016-6636

https://notcve.org/view.php?id=CVE-2016-6636

30 Sep 2016 — The OAuth authorization implementation in Pivotal Cloud Foundry (PCF) before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x before 3.4.4; UAA BOSH before 11.5 and 12.x before 12.5; Elastic Runtime before 1.6.40, 1.7.x before 1.7.21, and 1.8.x before 1.8.1; and Ops Manager 1.7.x before 1.7.13 and 1.8.x before 1.8.1 mishandles redirect_uri subdomains, which allows remote attackers to obtain implicit access tokens via a modified subdomain. La implementación de autorización OAuth en Pivotal Cloud Fo... • http://www.securityfocus.com/bid/93246 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •

CVSS: 9.6EPSS: 0%CPEs: 97EXPL: 0

CVE-2016-6637

https://notcve.org/view.php?id=CVE-2016-6637

30 Sep 2016 — Multiple cross-site request forgery (CSRF) vulnerabilities in Pivotal Cloud Foundry (PCF) before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x before 3.4.4; UAA BOSH before 11.5 and 12.x before 12.5; Elastic Runtime before 1.6.40, 1.7.x before 1.7.21, and 1.8.x before 1.8.2; and Ops Manager 1.7.x before 1.7.13 and 1.8.x before 1.8.1 allow remote attackers to hijack the authentication of unspecified victims for requests that approve or deny a scope via a profile or authorize approval page. Múlti... • http://www.securityfocus.com/bid/93245 • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 8.8EPSS: 0%CPEs: 77EXPL: 0

CVE-2016-6651

https://notcve.org/view.php?id=CVE-2016-6651

30 Sep 2016 — The UAA /oauth/token endpoint in Pivotal Cloud Foundry (PCF) before 243; UAA 2.x before 2.7.4.8, 3.x before 3.3.0.6, and 3.4.x before 3.4.5; UAA BOSH before 11.7 and 12.x before 12.6; Elastic Runtime before 1.6.40, 1.7.x before 1.7.21, and 1.8.x before 1.8.2; and Ops Manager 1.7.x before 1.7.13 and 1.8.x before 1.8.1 allows remote authenticated users to gain privileges by leveraging possession of a token. El dispositivo final UAA /oauth/token en Pivotal Cloud Foundry (PCF) en versiones anteriores a 243; UAA... • http://www.securityfocus.com/bid/93241 • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 7.5EPSS: 0%CPEs: 21EXPL: 0

CVE-2016-6639

https://notcve.org/view.php?id=CVE-2016-6639

18 Sep 2016 — Cloud Foundry PHP Buildpack (aka php-buildpack) before 4.3.18 and PHP Buildpack Cf-release before 242, as used in Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.38 and 1.7.x before 1.7.19 and other products, place the .profile file in the htdocs directory, which might allow remote attackers to obtain sensitive information via an HTTP GET request for this file. Cloud Foundry PHP Buildpack (también conocido como php-buildpack) en versiones anteriores a 4.3.18 y PHP Buildpack Cf-release en versiones an... • https://github.com/cloudfoundry/php-buildpack/commit/e2db3ccd4812e0c0aba20720fc51789d981aba67 • CWE-254: 7PK - Security Features •

CVSS: 7.5EPSS: 0%CPEs: 13EXPL: 0

CVE-2016-0896

https://notcve.org/view.php?id=CVE-2016-0896

18 Sep 2016 — Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.34 and 1.7.x before 1.7.12 places 169.254.0.0/16 in the all_open Application Security Group, which might allow remote attackers to bypass intended network-connectivity restrictions by leveraging access to the 169.254.169.254 address. Pivotal Cloud Foundry (PCF) Elastic Runtime en versiones anteriores a 1.6.34 y 1.7.x en versiones anteriores a 1.7.12 sitúa 169.254.0.0/16 en el all_open Application Security Group, lo que podría permitir a atacantes remoto... • http://www.securityfocus.com/bid/92161 • CWE-254: 7PK - Security Features •

CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0

CVE-2016-0926

https://notcve.org/view.php?id=CVE-2016-0926

18 Sep 2016 — Cross-site scripting (XSS) vulnerability in Apps Manager in Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.32 and 1.7.x before 1.7.8 allows remote attackers to inject arbitrary web script or HTML via unspecified input that improperly interacts with the AngularJS framework. Vulnerabilidad de XSS en Apps Manager en Pivotal Cloud Foundry (PCF) Elastic Runtime en versiones anteriores a 1.6.32 y 1.7.x en versiones anteriores a 1.7.8 permite a atacantes remotos inyectar secuencias de comandos web o HTML a... • http://www.securityfocus.com/bid/91677 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 16EXPL: 0

CVE-2016-0927

https://notcve.org/view.php?id=CVE-2016-0927

18 Sep 2016 — Cross-site scripting (XSS) vulnerability in Pivotal Cloud Foundry (PCF) Ops Manager before 1.6.17 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en Pivotal Cloud Foundry (PCF) Ops Manager en versiones anteriores a 1.6.17 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de vectores no especificados. • https://pivotal.io/security/cve-2016-0927 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.4EPSS: 0%CPEs: 9EXPL: 0

CVE-2016-0928

https://notcve.org/view.php?id=CVE-2016-0928

18 Sep 2016 — Multiple open redirect vulnerabilities in Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.30 and 1.7.x before 1.7.8 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. Múltiples vulnerabilidades de redirección abierta en Pivotal Cloud Foundry (PCF) Elastic Runtime en versiones anteriores a 1.6.30 y 1.7.x en versiones anteriores a 1.7.8 permite a atacantes remotos redireccionar usuarios a sitios web arbitrarios y llevar a cabo ataques p... • http://www.securityfocus.com/bid/91550 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •