CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2016-8219
https://notcve.org/view.php?id=CVE-2016-8219
An issue was discovered in Cloud Foundry Foundation cf-release versions prior to 250 and CAPI-release versions prior to 1.12.0. A user with the SpaceAuditor role is over-privileged with the ability to restage applications. This could cause application downtime if the restage fails. Se ha descubierto un problema en Cloud Foundry Foundation cf-release en versiones anteriores a 250 y las versiones CAPI-release anteriores a la 1.12.0. Un usuario con el rol SpaceAuditor tiene demasiados privilegios y la capacidad de realizar una copia intermedia de las aplicaciones. • https://www.cloudfoundry.org/cve-2016-8219 • CWE-269: Improper Privilege Management •
CVSS: 9.8EPSS: 0%CPEs: 29EXPL: 0CVE-2016-8218
https://notcve.org/view.php?id=CVE-2016-8218
An issue was discovered in Cloud Foundry Foundation routing-release versions prior to 0.142.0 and cf-release versions 203 to 231. Incomplete validation logic in JSON Web Token (JWT) libraries can allow unprivileged attackers to impersonate other users to the routing API, aka an "Unauthenticated JWT signing algorithm in routing" issue. Se detectó un problema en routing-release anterior a versión 0.142.0 y cf-release versiones 203 a 231 de Cloud Foundry Foundation. La lógica de comprobación incompleta en las bibliotecas JSON Web Token (JWT) puede permitir a los atacantes sin privilegios suplantar a otros usuarios en la API de enrutamiento, también se conoce como un problema de "Unauthenticated JWT signing algorithm in routing". • https://www.cloudfoundry.org/cve-2016-8218 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2016-6655
https://notcve.org/view.php?id=CVE-2016-6655
An issue was discovered in Cloud Foundry Foundation Cloud Foundry release versions prior to v245 and cf-mysql-release versions prior to v31. A command injection vulnerability was discovered in a common script used by many Cloud Foundry components. A malicious user may exploit numerous vectors to execute arbitrary commands on servers running Cloud Foundry. Un problema fue descubierto en Cloud Foundry Foundation Cloud Foundry liberado en versiones anteriores a la v245 y cf-mysql liberado anterior a la v31. Una inyección de comando fue descubierta en un script común usado por varios componentes de Cloud Foundry. • http://www.securityfocus.com/bid/93889 https://www.cloudfoundry.org/cve-2016-6655 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2015-3190
https://notcve.org/view.php?id=CVE-2015-3190
With Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier the UAA logout link is susceptible to an open redirect which allows an attacker to insert malicious web page as a redirect parameter. En Cloud Foundry Runtime versiones v209 o anteriores, UAA Standalone versiones 2.2.6 o ateriores y Pivotal Cloud Foundry Runtime versiones 1.4.5 o anteriores, el enlace del UAA logout es susceptible a una redirección abierta que permitiría a un atacante insertar páginas web maliciosas en un parámetro de redirección. • https://pivotal.io/security/cve-2015-3190 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2015-3191
https://notcve.org/view.php?id=CVE-2015-3191
With Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier the change_email form in UAA is vulnerable to a CSRF attack. This allows an attacker to trigger an e-mail change for a user logged into a cloud foundry instance via a malicious link on a attacker controlled site. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected. En Cloud Foundry Runtime versiones v209 y anteriores, UAA Standalone versiones 2.2.6 o anteriores y Pivotal Cloud Foundry Runtime, versiones 1.4.5 o anteriores, el formulario change_email en UAA es vulnerable a un ataque de tipo CSFR. • https://pivotal.io/security/cve-2015-3191 • CWE-352: Cross-Site Request Forgery (CSRF) •