CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2018-1195
https://notcve.org/view.php?id=CVE-2018-1195
19 Mar 2018 — In Cloud Controller versions prior to 1.46.0, cf-deployment versions prior to 1.3.0, and cf-release versions prior to 283, Cloud Controller accepts refresh tokens for authentication where access tokens are expected. This exposes a vulnerability where a refresh token that would otherwise be insufficient to obtain an access token, either due to lack of client credentials or revocation, would allow authentication. En Cloud Controller, en versiones anteriores a la 1.46.0, versiones cf-deployment anteriores a la... • https://www.cloudfoundry.org/blog/cve-2018-1195 • CWE-613: Insufficient Session Expiration •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2018-1190
https://notcve.org/view.php?id=CVE-2018-1190
04 Jan 2018 — An issue was discovered in these Pivotal Cloud Foundry products: all versions prior to cf-release v270, UAA v3.x prior to v3.20.2, and UAA bosh v30.x versions prior to v30.8 and all other versions prior to v45.0. A cross-site scripting (XSS) attack is possible in the clientId parameter of a request to the UAA OpenID Connect check session iframe endpoint used for single logout session management. Se ha encontrado un problema en los siguientes productos Pivotal Cloud Foundry: todas las versiones anteriores a ... • http://www.securityfocus.com/bid/102427 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2017-14389
https://notcve.org/view.php?id=CVE-2017-14389
28 Nov 2017 — An issue was discovered in Cloud Foundry Foundation capi-release (all versions prior to 1.45.0), cf-release (all versions prior to v280), and cf-deployment (all versions prior to v1.0.0). The Cloud Controller does not prevent space developers from creating subdomains to an already existing route that belongs to a different user in a different org and space, aka an "Application Subdomain Takeover." Se ha descubierto un problema en Cloud Foundry Foundation capi-release (todas las versiones anteriores a la 1.4... • https://www.cloudfoundry.org/cve-2017-14389 •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2017-8031
https://notcve.org/view.php?id=CVE-2017-8031
27 Nov 2017 — An issue was discovered in Cloud Foundry Foundation cf-release (all versions prior to v279) and UAA (30.x versions prior to 30.6, 45.x versions prior to 45.4, 52.x versions prior to 52.1). In some cases, the UAA allows an authenticated user for a particular client to revoke client tokens for other users on the same client. This occurs only if the client is using opaque tokens or JWT tokens validated using the check_token endpoint. A malicious actor could cause denial of service. Se ha descubierto un problem... • http://www.securityfocus.com/bid/101967 •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2017-8047
https://notcve.org/view.php?id=CVE-2017-8047
03 Oct 2017 — In Cloud Foundry router routing-release all versions prior to v0.163.0 and cf-release all versions prior to v274, in some applications, it is possible to append a combination of characters to the URL that will allow for an open redirect. An attacker could exploit this as a phishing attack to gain access to user credentials or other sensitive data. NOTE: 274 resolves the vulnerability but has a serious bug that is fixed in 275. En todas las versiones anteriores a la 0.163.0 del desarrollo routing-release y e... • https://www.cloudfoundry.org/cve-2017-8047 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 7.5EPSS: 0%CPEs: 56EXPL: 0CVE-2017-8037
https://notcve.org/view.php?id=CVE-2017-8037
21 Aug 2017 — In Cloud Foundry Foundation CAPI-release versions after v1.6.0 and prior to v1.38.0 and cf-release versions after v244 and prior to v270, there is an incomplete fix for CVE-2017-8035. If you took steps to remediate CVE-2017-8035 you should also upgrade to fix this CVE. A carefully crafted CAPI request from a Space Developer can allow them to gain access to files on the Cloud Controller VM for that installation, aka an Information Leak / Disclosure. En Cloud Foundry Foundation CAPI-release en versiones poste... • http://www.securityfocus.com/bid/100448 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2017-8035
https://notcve.org/view.php?id=CVE-2017-8035
25 Jul 2017 — An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release versions after v1.6.0 and prior to v1.35.0 and cf-release versions after v244 and prior to v268. A carefully crafted CAPI request from a Space Developer can allow them to gain access to files on the Cloud Controller VM for that installation. Se ha descubierto en la API Cloud Controller en Cloud Foundry Foundation CAPI-release en versiones posteriores a 1.6.0 y anteriores a 1.35.0 y las versiones cf-release posterior... • https://www.cloudfoundry.org/cve-2017-8035 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2017-8033
https://notcve.org/view.php?id=CVE-2017-8033
25 Jul 2017 — An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release versions prior to v1.35.0 and cf-release versions prior to v268. A filesystem traversal vulnerability exists in the Cloud Controller that allows a space developer to escalate privileges by pushing a specially crafted application that can write arbitrary files to the Cloud Controller VM. Se ha descubierto en la API Cloud Controller en Cloud Foundry Foundation CAPI-release en versiones anteriores a 1.35.0 y las versio... • https://www.cloudfoundry.org/cve-2017-8033 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.6EPSS: 0%CPEs: 3EXPL: 0CVE-2017-8034
https://notcve.org/view.php?id=CVE-2017-8034
17 Jul 2017 — The Cloud Controller and Router in Cloud Foundry (CAPI-release capi versions prior to v1.32.0, Routing-release versions prior to v0.159.0, CF-release versions prior to v267) do not validate the issuer on JSON Web Tokens (JWTs) from UAA. With certain multi-zone UAA configurations, zone administrators are able to escalate their privileges. El controlador y el enrutador de nube en Cloud Foundry (publicación de CAPI versiones de capi anteriores a v1.32.0, publicación de enrutamiento versión anterior a v0.159.0,... • https://www.cloudfoundry.org/cve-2017-8034 • CWE-565: Reliance on Cookies without Validation and Integrity Checking •
CVSS: 9.8EPSS: 0%CPEs: 73EXPL: 0CVE-2017-4992
https://notcve.org/view.php?id=CVE-2017-4992
13 Jun 2017 — An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v261; UAA release 2.x versions prior to v2.7.4.17, 3.6.x versions prior to v3.6.11, 3.9.x versions prior to v3.9.13, and other versions prior to v4.2.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.15, 24.x versions prior to v24.10, 30.x versions prior to 30.3, and other versions prior to v37. There is privilege escalation (arbitrary password reset) with user invitations. Se detectó un problema en cf-release ve... • https://www.cloudfoundry.org/cve-2017-4992 • CWE-269: Improper Privilege Management •