CVSS: 8.1EPSS: 0%CPEs: 3EXPL: 0CVE-2016-6659
https://notcve.org/view.php?id=CVE-2016-6659
Cloud Foundry before 248; UAA 2.x before 2.7.4.12, 3.x before 3.6.5, and 3.7.x through 3.9.x before 3.9.3; and UAA bosh release (aka uaa-release) before 13.9 for UAA 3.6.5 and before 24 for UAA 3.9.3 allow attackers to gain privileges by accessing UAA logs and subsequently running a specially crafted application that interacts with a configured SAML provider. Cloud Foundry en versiones anteriores a 248; UAA 2.x en versiones anteriores a 2.7.4.12, 3.x en versiones anteriores a 3.6.5 y 3.7.x hasta la versión 3.9.x en versiones anteriores a 3.9.3 y UAA bosh release (también conocido como uaa-release) en versiones anteriores a 13.9 para UAA 3.6.5 y en versiones anteriores a 24 para UAA 3.9.3 permite a atacantes remotos obtener privilegios para obtener acceso y acceder a los registros y posteriormete ejecutar una aplicación espcial manipulada que interactua con la configuración SAML del proveedor. • http://www.securityfocus.com/bid/95085 https://www.cloudfoundry.org/cve-2016-6659 • CWE-287: Improper Authentication •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2016-6656
https://notcve.org/view.php?id=CVE-2016-6656
An issue was discovered in Pivotal Greenplum before 4.3.10.0. Creation of external tables using GPHDFS protocol has a vulnerability whereby arbitrary commands can be injected into the system. In order to exploit this vulnerability the user must have superuser 'gpadmin' access to the system or have been granted GPHDFS protocol permissions in order to create a GPHDFS external table. Ha sido descubierto un problema en Pivotal Greenplum en versiones anteriores a 4.3.10.0. La creación de tablas externas usando el protocolo GPHDFS tiene una vulnerabilidad por la cual se pueden inyectar comandos arbitrarios en el sistema. • http://www.securityfocus.com/bid/94954 https://pivotal.io/security/cve-2016-6656 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 7.4EPSS: 0%CPEs: 43EXPL: 0CVE-2016-6657
https://notcve.org/view.php?id=CVE-2016-6657
An open redirect vulnerability has been detected with some Pivotal Cloud Foundry Elastic Runtime components. Users of affected versions should apply the following mitigation: Upgrade PCF Elastic Runtime 1.8.x versions to 1.8.12 or later. Upgrade PCF Ops Manager 1.7.x versions to 1.7.18 or later and 1.8.x versions to 1.8.10 or later. Una vulnerabilidad de redirección abierta ha sido detectada con algunos componentes Pivotal Cloud Foundry Elastic Runtime. Los usuarios de las versiones afectadas deben aplicar la siguiente mitigación: Actualizar PCF Elastic Runtime 1.8.x en versiones 1.8.12 o posteriores. • http://www.securityfocus.com/bid/94126 https://pivotal.io/security/cve-2016-6657 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2015-8786 – rabbitmq-server: DoS via lengths_age or lengths_incr parameter in the management plugin
https://notcve.org/view.php?id=CVE-2015-8786
The Management plugin in RabbitMQ before 3.6.1 allows remote authenticated users with certain privileges to cause a denial of service (resource consumption) via the (1) lengths_age or (2) lengths_incr parameter. El plugin Management en RabbitMQ en versiones anteriores a 3.6.1 permite a usuarios remotos autenticados con ciertos privilegios provocar una denegación de servicio (consumo de recursos) a través del parámetro (1) lengths_age o (2) lengths_incr. A resource-consumption flaw was found in RabbitMQ Server, where the lengths_age or lengths_incr parameters were not validated in the management plugin. Remote, authenticated users with certain privileges could exploit this flaw to cause a denial of service by passing values which were too large. • http://rhn.redhat.com/errata/RHSA-2017-0226.html http://rhn.redhat.com/errata/RHSA-2017-0530.html http://rhn.redhat.com/errata/RHSA-2017-0531.html http://rhn.redhat.com/errata/RHSA-2017-0532.html http://rhn.redhat.com/errata/RHSA-2017-0533.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.securityfocus.com/bid/91508 https://github.com/rabbitmq/rabbitmq-management/issues/97 https://github.com/rabbitmq/rabbitmq-server/releases/tag/ • CWE-399: Resource Management Errors CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2016-6653
https://notcve.org/view.php?id=CVE-2016-6653
The MariaDB audit_plugin component in Pivotal Cloud Foundry (PCF) cf-mysql-release 27 and 28 allows remote attackers to obtain sensitive information by reading syslog messages, as demonstrated by cleartext credentials. El componente audit_plugin de MariaDB en Pivotal Cloud Foundry (PCF) cf-mysql-release 27 y 28 permite a atacantes remotos obtener información sensible leyendo los mensajes de registro de sistema, como se demuestra por las credenciales en texto plano. • http://www.securityfocus.com/bid/93480 https://pivotal.io/security/cve-2016-6653 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •