CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2018-1277
https://notcve.org/view.php?id=CVE-2018-1277
30 Apr 2018 — Cloud Foundry Garden-runC, versions prior to 1.13.0, does not correctly enforce disc quotas for Docker image layers. A remote authenticated user may push an app with a malicious Docker image that will consume more space on a Diego cell than allocated in their quota, potentially causing a DoS against the cell. Cloud Foundry Garden-runC, en versiones anteriores a la 1.13.0, no aplica correctamente las cuotas de disco para las capas de imagen Docker. Un usuario autenticado remoto podría insertar una aplicación... • https://www.cloudfoundry.org/blog/cve-2018-1277 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2018-1191
https://notcve.org/view.php?id=CVE-2018-1191
29 Mar 2018 — Cloud Foundry Garden-runC, versions prior to 1.11.0, contains an information exposure vulnerability. A user with access to Garden logs may be able to obtain leaked credentials and perform authenticated actions using those credentials. Cloud Foundry Garden-runC, en versiones anteriores a la 1.11.0, contiene una vulnerabilidad de exposición de información. Un usuario con acceso a los registros de Garden podría ser capaz de obtener credenciales filtradas y realizar acciones autenticadas mediante el uso de esas... • https://www.cloudfoundry.org/blog/cve-2018-1191 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-215: Insertion of Sensitive Information Into Debugging Code •
CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2018-1221
https://notcve.org/view.php?id=CVE-2018-1221
19 Mar 2018 — In cf-deployment before 1.14.0 and routing-release before 0.172.0, the Cloud Foundry Gorouter mishandles WebSocket requests for AWS Application Load Balancers (ALBs) and some other HTTP-aware Load Balancers. A user with developer privileges could use this vulnerability to steal data or cause denial of service. En cf-deployment en versiones anteriores a la 1.14.0 y routing-release en versiones anteriores a la 0.172.0, Cloud Foundry Gorouter gestiona de manera incorrecta las peticiones WebSocket para AWS Appl... • https://www.cloudfoundry.org/blog/cve-2018-1221 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2018-1195
https://notcve.org/view.php?id=CVE-2018-1195
19 Mar 2018 — In Cloud Controller versions prior to 1.46.0, cf-deployment versions prior to 1.3.0, and cf-release versions prior to 283, Cloud Controller accepts refresh tokens for authentication where access tokens are expected. This exposes a vulnerability where a refresh token that would otherwise be insufficient to obtain an access token, either due to lack of client credentials or revocation, would allow authentication. En Cloud Controller, en versiones anteriores a la 1.46.0, versiones cf-deployment anteriores a la... • https://www.cloudfoundry.org/blog/cve-2018-1195 • CWE-613: Insufficient Session Expiration •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2017-14389
https://notcve.org/view.php?id=CVE-2017-14389
28 Nov 2017 — An issue was discovered in Cloud Foundry Foundation capi-release (all versions prior to 1.45.0), cf-release (all versions prior to v280), and cf-deployment (all versions prior to v1.0.0). The Cloud Controller does not prevent space developers from creating subdomains to an already existing route that belongs to a different user in a different org and space, aka an "Application Subdomain Takeover." Se ha descubierto un problema en Cloud Foundry Foundation capi-release (todas las versiones anteriores a la 1.4... • https://www.cloudfoundry.org/cve-2017-14389 •