Cloud Foundry vulnerabilities
80 CVEs and advisories name Cloud Foundry as an affected vendor, newest first. Follow it as a feed.
- CVE-2018-15761UAA Privilege Escalation
- CVE-2018-15796Signing Key Extraction in Bits Service Release
- CVE-2018-15755CF networking internal policy server SQL injection
- CVE-2018-1264Log Cache logs UAA client secret on startup
- CVE-2018-11083Bosh accepts refresh tokens in place of an access token
- CVE-2018-11082Cloud Foundry UAA MFA does not prevent brute force of MFA code
- CVE-2018-11084Garden-runC prevents deletion of some app environments
- CVE-2018-1223Cloud Foundry Container Runtime (kubo-release), versions prior to 0.14.0, may leak UAA and vCenter credentials to application logs.
- CVE-2018-11047Cloud Foundry UAA, versions 4.19 prior to 4.19.2 and 4.12 prior to 4.12.4 and 4.10 prior to 4.10.2 and 4.7 prior to 4.7.6 and 4.5 prior to 4
- CVE-2016-0708Applications deployed to Cloud Foundry, versions v166 through v227, may be vulnerable to a remote disclosure of information, including, but
- CVE-2018-11041Cloud Foundry UAA, versions later than 4.6.0 and prior to 4.19.0 except 4.10.1 and 4.7.5 and uaa-release versions later than v48 and prior t
- CVE-2018-1269Cloud Foundry Loggregator, versions 89.x prior to 89.5 or 96.x prior to 96.1 or 99.x prior to 99.1 or 101.x prior to 101.9 or 102.x prior to
- CVE-2018-1268Cloud Foundry Loggregator, versions 89.x prior to 89.5 or 96.x prior to 96.1 or 99.x prior to 99.1 or 101.x prior to 101.9 or 102.x prior to
- CVE-2018-1265Cloud Foundry Diego, release versions prior to 2.8.0, does not properly sanitize file paths in tar and zip files headers.
- CVE-2018-1193Cloud Foundry routing-release, versions prior to 0.175.0, lacks sanitization for user-provided X-Forwarded-Proto headers.
- CVE-2018-1276Windows 2012R2 stemcells, versions prior to 1200.17, contain an information exposure vulnerability on vSphere.
- CVE-2018-1262Cloud Foundry Foundation UAA, versions 4.12.X and 4.13.X, introduced a feature which could allow privilege escalation across identity zones
- CVE-2018-1277Cloud Foundry Garden-runC, versions prior to 1.13.0, does not correctly enforce disc quotas for Docker image layers.
- CVE-2016-2169Cloud Foundry Cloud Controller, capi-release versions prior to 1.0.0 and cf-release versions prior to v237, contain a business logic flaw.
- CVE-2018-1191Cloud Foundry Garden-runC, versions prior to 1.11.0, contains an information exposure vulnerability.