Cloud Foundry vulnerabilities
80 CVEs and advisories name Cloud Foundry as an affected vendor, newest first. Follow it as a feed.
- CVE-2019-11290Cloud Foundry UAA logs query parameters in tomcat access file
- CVE-2019-11289A forged route service request using an invalid nonce can cause the gorouter to panic and crash
- CVE-2019-11283Password leak in smbdriver logs
- CVE-2019-11282UAA is vulnerable to a Blind SCIM injection leading to information disclosure
- CVE-2019-11279Privilege Escalation via Scope Manipulation in UAA
- CVE-2019-11278Privilege Escalation via Blind SCIM Injection in UAA
- CVE-2019-11277Volume Services is vulnerable to an LDAP injection attack
- CVE-2019-11274UAA SCIM Filter XSS
- CVE-2019-3800CF CLI writes the client id and secret to config file
- CVE-2019-11270UAA clients.write vulnerability
- CVE-2019-3794UAA - Login app subject to clickjacking attack
- CVE-2019-11268UAA SQL Identity Zone Vulnerability
- CVE-2019-3787UAA defaults email address to an insecure domain
- CVE-2019-11271Bosh Deployment logs leak sensitive information
- CVE-2019-3801Java Projects using HTTP to fetch dependencies
- CVE-2019-3788UAA redirect-uri allows wildcard in the subdomain
- CVE-2019-3789Gorouter allows space developer to hijack route services hosted outside the platform
- CVE-2019-3786BBR could run arbitrary scripts on deployment VMs
- CVE-2019-3798Escalation of Privileges in Cloud Controller
- CVE-2019-3785Cloud Controller provides signed URL with write authorization to read only user
- CVE-2019-3780Cloud Foundry Container Runtime Leaks IAAS Credentials
- CVE-2019-3779Cloud Foundry Container Runtime allows a user to bypass security policy when talking to ETCD
- CVE-2019-3784Cloud Foundry Stratos contains a Session Collision Vulnerability
- CVE-2019-3783Cloud Foundry Stratos Deploys With Public Default Session Store Secret
- CVE-2019-3781CF CLI does not sanitize user's password in verbose/trace/debug
- CVE-2019-3775UAA allows users to modify their own email address
- CVE-2019-3782CredHub CLI writes environment variable credentials to disk
- CVE-2018-15754UAA can issue tokens across identity providers if users with matching usernames exist
- CVE-2018-15800Timing attack allows extraction of signing key in Bits Service
- CVE-2018-15797NFS Volume release errand leaks cf admin credentials in logs