CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2019-11282 – UAA is vulnerable to a Blind SCIM injection leading to information disclosure
https://notcve.org/view.php?id=CVE-2019-11282
23 Oct 2019 — Cloud Foundry UAA, versions prior to v74.3.0, contains an endpoint that is vulnerable to SCIM injection attack. A remote authenticated malicious user with scim.invite scope can craft a request with malicious content which can leak information about users of the UAA. Cloud Foundry UAA, versiones anteriores a v74.3.0, contiene un endpoint que es vulnerable al ataque de inyección SCIM. Un usuario malicioso autenticado remoto con alcance de scim.invite puede diseñar una petición con contenido malicioso que pued... • https://www.cloudfoundry.org/blog/cve-2019-11282 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 9EXPL: 0CVE-2019-11270 – UAA clients.write vulnerability
https://notcve.org/view.php?id=CVE-2019-11270
05 Aug 2019 — Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or scope can bypass the restrictions imposed on clients created via 'clients.write' and create clients with arbitrary scopes that the creator does not possess. Cloud Foundry UAA versiones anteriores a v73.4.0, contienen una vulnerabilidad en la que un cliente malicioso bajo posesión de la autoridad o el alcance "clients.write" puede omitir las restricciones impuestas a los cl... • https://pivotal.io/security/cve-2019-11270 • CWE-269: Improper Privilege Management CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-3794 – UAA - Login app subject to clickjacking attack
https://notcve.org/view.php?id=CVE-2019-3794
18 Jul 2019 — Cloud Foundry UAA, versions prior to v73.4.0, does not set an X-FRAME-OPTIONS header on various endpoints. A remote user can perform clickjacking attacks on UAA's frontend sites. Cloud Foundry UAA, versiones anteriores a v73.4.0, no establece un encabezado X-FRAME-OPTIONS en varios puntos finales. Un usuario remoto puede realizar ataques de clickjacking en los sitios front-end de UAA. • https://www.cloudfoundry.org/blog/cve-2019-3794 • CWE-284: Improper Access Control CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 9.9EPSS: 0%CPEs: 2EXPL: 0CVE-2018-15761 – UAA Privilege Escalation
https://notcve.org/view.php?id=CVE-2018-15761
19 Nov 2018 — Cloud Foundry UAA release, versions prior to v64.0, and UAA, versions prior to 4.23.0, contains a validation error which allows for privilege escalation. A remote authenticated user may modify the url and content of a consent page to gain a token with arbitrary scopes that escalates their privileges. Cloud Foundry UAA release, en versiones anteriores a la v64.0, y UAA, en versiones anteriores a la 4.23.0, contiene un error de validación que permite el escalado de privilegios. Un usuario autenticado remoto p... • https://www.cloudfoundry.org/blog/cve-2018-15761 •
CVSS: 6.6EPSS: 0%CPEs: 81EXPL: 0CVE-2017-8032
https://notcve.org/view.php?id=CVE-2017-8032
10 Jul 2017 — In Cloud Foundry cf-release versions prior to v264; UAA release all versions of UAA v2.x.x, 3.6.x versions prior to v3.6.13, 3.9.x versions prior to v3.9.15, 3.20.x versions prior to v3.20.0, and other versions prior to v4.4.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.17, 24.x versions prior to v24.12. 30.x versions prior to 30.5, and other versions prior to v41, zone administrators are allowed to escalate their privileges when mapping permissions for an external provider. En cf-release... • https://www.cloudfoundry.org/cve-2017-8032 • CWE-269: Improper Privilege Management •
CVSS: 8.1EPSS: 0%CPEs: 4EXPL: 0CVE-2017-4963
https://notcve.org/view.php?id=CVE-2017-4963
13 Jun 2017 — An issue was discovered in Cloud Foundry Foundation Cloud Foundry release v252 and earlier versions, UAA stand-alone release v2.0.0 - v2.7.4.12 & v3.0.0 - v3.11.0, and UAA bosh release v26 & earlier versions. UAA is vulnerable to session fixation when configured to authenticate against external SAML or OpenID Connect based identity providers. Se ha descubierto un problema en Cloud Foundry Foundation Cloud Foundry release v252 y versiones anteriores, UAA stand-alone release v2.0.0 - v2.7.4.12 y v3.0.0 - v3.1... • https://www.cloudfoundry.org/cve-2017-4963 • CWE-384: Session Fixation •
CVSS: 7.5EPSS: 0%CPEs: 62EXPL: 0CVE-2017-4972
https://notcve.org/view.php?id=CVE-2017-4972
13 Jun 2017 — An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v257; UAA release 2.x versions prior to v2.7.4.14, 3.6.x versions prior to v3.6.8, 3.9.x versions prior to v3.9.10, and other versions prior to v3.15.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.12, 24.x versions prior to v24.7, and other versions prior to v30. An attacker can use a blind SQL injection attack to query the contents of the UAA database. Se detectó un problema en cf-release versiones anteriores... • https://www.cloudfoundry.org/cve-2017-4972 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 58EXPL: 0CVE-2017-4973
https://notcve.org/view.php?id=CVE-2017-4973
13 Jun 2017 — An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v257; UAA release 2.x versions prior to v2.7.4.14, 3.6.x versions prior to v3.6.8, 3.9.x versions prior to v3.9.10, and other versions prior to v3.15.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.12, 24.x versions prior to v24.7, and other versions prior to v30. A vulnerability has been identified with the groups endpoint in UAA allowing users to elevate their privileges. Se detectó un problema en cf-release ... • https://www.cloudfoundry.org/cve-2017-4973 • CWE-269: Improper Privilege Management •
CVSS: 6.5EPSS: 0%CPEs: 64EXPL: 0CVE-2017-4974
https://notcve.org/view.php?id=CVE-2017-4974
13 Jun 2017 — An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v258; UAA release 2.x versions prior to v2.7.4.15, 3.6.x versions prior to v3.6.9, 3.9.x versions prior to v3.9.11, and other versions prior to v3.16.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.13, 24.x versions prior to v24.8, and other versions prior to v30.1. An authorized user can use a blind SQL injection attack to query the contents of the UAA database, aka "Blind SQL Injection with privileged UAA end... • http://www.securityfocus.com/bid/99254 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.2EPSS: 0%CPEs: 66EXPL: 0CVE-2017-4991
https://notcve.org/view.php?id=CVE-2017-4991
13 Jun 2017 — An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v260; UAA release 2.x versions prior to v2.7.4.16, 3.6.x versions prior to v3.6.10, 3.9.x versions prior to v3.9.12, and other versions prior to v3.17.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.14, 24.x versions prior to v24.9, 30.x versions prior to 30.2, and other versions prior to v36. Privileged users in one zone are allowed to perform a password reset for users in a different zone. Se detectó un probl... • https://www.cloudfoundry.org/cve-2017-4991 • CWE-269: Improper Privilege Management •