# cve.now: Pivotal

The newest entries naming Pivotal as an affected vendor (up to 200), of 67 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2020-5409](https://cve.now/CVE-2020-5409.md): Concourse Open Redirect in the /sky/login endpoint (CVSS 7.6)
- [CVE-2020-5406](https://cve.now/CVE-2020-5406.md): PCF Autoscaling logs its database credentials (no CVSS)
- [CVE-2020-5403](https://cve.now/CVE-2020-5403.md): DoS Via Malformed URL with Reactor Netty HTTP Server (CVSS 6.5)
- [CVE-2020-5404](https://cve.now/CVE-2020-5404.md): Authentication Leak On Redirect With Reactor Netty HttpClient (CVSS 6.5)
- [CVE-2019-11288](https://cve.now/CVE-2019-11288.md): tcServer JMX Socket Listener Registry Rebinding Local Privilege Escalation (CVSS 7.3)
- [CVE-2013-6430](https://cve.now/CVE-2013-6430.md): The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properl (no CVSS)
- [CVE-2019-11292](https://cve.now/CVE-2019-11292.md): Pivotal Ops Manager logs query parameters in tomcat access file (CVSS 8.8)
- [CVE-2019-11287](https://cve.now/CVE-2019-11287.md): RabbitMQ Web Management Plugin DoS via heap overflow (CVSS 4.5)
- [CVE-2019-11291](https://cve.now/CVE-2019-11291.md): RabbitMQ XSS attack via federation and shovel endpoints (CVSS 3.1)
- [CVE-2019-11284](https://cve.now/CVE-2019-11284.md): Reactor Netty authentication leak in redirects (CVSS 6.8)
- [CVE-2019-11281](https://cve.now/CVE-2019-11281.md): RabbitMQ XSS attack (CVSS 2.4)
- [CVE-2019-11275](https://cve.now/CVE-2019-11275.md): CSV Injection in usage report downloaded from Pivotal Application Manager (CVSS 3.5)
- [CVE-2019-11280](https://cve.now/CVE-2019-11280.md): Privilege escalation through the invitations service (CVSS 8.8)
- [CVE-2019-11276](https://cve.now/CVE-2019-11276.md): Apps Manager sends tokens to Spring apps via HTTP (CVSS 5.4)
- [CVE-2019-11273](https://cve.now/CVE-2019-11273.md): PKS Telemetry logs credentials (CVSS 2.2)
- [CVE-2019-3790](https://cve.now/CVE-2019-3790.md): Ops Manager uaa client issues tokens after refresh token expiration (CVSS 6.1)
- [CVE-2019-3801](https://cve.now/CVE-2019-3801.md): Java Projects using HTTP to fetch dependencies (CVSS 8.7)
- [CVE-2019-3788](https://cve.now/CVE-2019-3788.md): UAA redirect-uri allows wildcard in the subdomain (CVSS 8.7)
- [CVE-2019-3793](https://cve.now/CVE-2019-3793.md): Invitations Service supports HTTP connections (CVSS 8.1)
- [CVE-2019-3792](https://cve.now/CVE-2019-3792.md): Concourse 5.0.0 SQL Injection vulnerability (CVSS 6.8)
- [CVE-2019-3777](https://cve.now/CVE-2019-3777.md): Apps Manager unverified SSL certs in Cloud Controller proxy (CVSS 8.0)
- [CVE-2019-3776](https://cve.now/CVE-2019-3776.md): Reflected XSS in Pivotal Operations Manager (CVSS 7.2)
- [CVE-2019-3803](https://cve.now/CVE-2019-3803.md): Concourse includes token in CLI authentication callback (CVSS 4.5)
- [CVE-2018-15798](https://cve.now/CVE-2018-15798.md): Pivotal Concourse allows malicious redirect urls on login (CVSS 7.6)
- [CVE-2018-1279](https://cve.now/CVE-2018-1279.md): RabbitMQ cluster compromise due to deterministically generated cookie (CVSS 8.5)
- [CVE-2018-15759](https://cve.now/CVE-2018-15759.md): On Demand Services SDK Timing Attack Vulnerability (CVSS 9.1)
- [CVE-2018-15758](https://cve.now/CVE-2018-15758.md): Privilege Escalation in spring-security-oauth2 (CVSS 9.6)
- [CVE-2018-15756](https://cve.now/CVE-2018-15756.md): DoS Attack via Range Requests (CVSS 7.5)
- [CVE-2018-15763](https://cve.now/CVE-2018-15763.md): PKS leaks IaaS Credentials to Application Logs (CVSS 9.0)
- [CVE-2018-11081](https://cve.now/CVE-2018-11081.md): Pivotal Operations Manager UAA config - temp Ram Disk (CVSS 7.9)
- [CVE-2018-1198](https://cve.now/CVE-2018-1198.md): Pivotal Cloud Cache, versions prior to 1.3.1, prints a superuser password in plain text during BOSH deployment logs. (no CVSS)
- [CVE-2018-11088](https://cve.now/CVE-2018-11088.md): Pivotal Applications Manager in Pivotal Application Service, versions 2.0 prior to 2.0.21 and 2.1 prior to 2.1.13 and 2.2 prior to 2.2.5, co (no CVSS)
- [CVE-2018-11086](https://cve.now/CVE-2018-11086.md): Pivotal Usage Service in Pivotal Application Service, versions 2.0 prior to 2.0.21 and 2.1 prior to 2.1.13 and 2.2 prior to 2.2.5, contains (no CVSS)
- [CVE-2018-11087](https://cve.now/CVE-2018-11087.md): TLS validation error (no CVSS)
- [CVE-2016-0715](https://cve.now/CVE-2016-0715.md): Pivotal Cloud Foundry Elastic Runtime version 1.4.0 through 1.4.5, 1.5.0 through 1.5.11 and 1.6.0 through 1.6.11 is vulnerable to a remote i (no CVSS)
- [CVE-2018-11044](https://cve.now/CVE-2018-11044.md): Pivotal Apps Manager included in Pivotal Application Service, versions 2.2.x prior to 2.2.1 and 2.1.x prior to 2.1.8 and 2.0.x prior to 2.0. (no CVSS)
- [CVE-2018-11049](https://cve.now/CVE-2018-11049.md): RSA Identity Governance and Lifecycle Uncontrolled Search Path Vulnerability (no CVSS)
- [CVE-2018-11045](https://cve.now/CVE-2018-11045.md): Pivotal Operations Manager, versions 2.1 prior to 2.1.6 and 2.0 prior to 2.0.15 and 1.12 prior to 1.12.22, contains a static Linux Random Nu (no CVSS)
- [CVE-2018-11046](https://cve.now/CVE-2018-11046.md): Pivotal Operations Manager, versions 2.1.x prior to 2.1.6 and version 2.0.14, includes NGINX packages that lacks security vulnerability patc (no CVSS)
- [CVE-2018-11040](https://cve.now/CVE-2018-11040.md): Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable (no CVSS)
- [CVE-2018-11039](https://cve.now/CVE-2018-11039.md): Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to c (no CVSS)
- [CVE-2018-1263](https://cve.now/CVE-2018-1263.md): Addresses partial fix in CVE-2018-1261. (no CVSS)
- [CVE-2018-1280](https://cve.now/CVE-2018-1280.md): Pivotal Greenplum Command Center versions 2.x prior to 2.5.1 contains a blind SQL injection vulnerability. (no CVSS)
- [CVE-2018-1278](https://cve.now/CVE-2018-1278.md): Apps Manager included in Pivotal Application Service, versions 1.12.x prior to 1.12.22, 2.0.x prior to 2.0.13, and 2.1.x prior to 2.1.4 cont (no CVSS)
- [CVE-2018-1261](https://cve.now/CVE-2018-1261.md): Spring-integration-zip versions prior to 1.0.1 exposes an arbitrary file write vulnerability, which can be achieved using a specially crafte (no CVSS)
- [CVE-2018-1260](https://cve.now/CVE-2018-1260.md): Spring Security OAuth, versions 2.3 prior to 2.3.3, 2.2 prior to 2.2.2, 2.1 prior to 2.1.2, 2.0 prior to 2.0.15 and older unsupported versio (no CVSS)
- [CVE-2018-1259](https://cve.now/CVE-2018-1259.md): Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, con (no CVSS)
- [CVE-2018-1258](https://cve.now/CVE-2018-1258.md): Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using met (no CVSS)
- [CVE-2018-1257](https://cve.now/CVE-2018-1257.md): Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expos (no CVSS)
- [CVE-2018-1256](https://cve.now/CVE-2018-1256.md): Spring Cloud SSO Connector, version 2.1.2, contains a regression which disables issuer validation in resource servers that are not bound to (no CVSS)
- [CVE-2016-8220](https://cve.now/CVE-2016-8220.md): Pivotal Gemfire for PCF, versions 1.6.x prior to 1.6.5.0 and 1.7.x prior to 1.7.1.0, contain an information disclosure vulnerability. (no CVSS)
- [CVE-2017-8046](https://cve.now/CVE-2017-8046.md): Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1 (no CVSS)
- [CVE-2016-5007](https://cve.now/CVE-2016-5007.md): Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization (no CVSS)
- [CVE-2016-4977](https://cve.now/CVE-2016-4977.md): When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the response\_t (no CVSS)
- [CVE-2016-4435](https://cve.now/CVE-2016-4435.md): An endpoint of the Agent running on the BOSH Director VM with stemcell versions prior to 3232.6 and 3146.13 may allow unauthenticated client (no CVSS)
- [CVE-2016-3084](https://cve.now/CVE-2016-3084.md): The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Log (no CVSS)
- [CVE-2016-2165](https://cve.now/CVE-2016-2165.md): The Loggregator Traffic Controller endpoints in cf-release v231 and lower, Pivotal Elastic Runtime versions prior to 1.5.19 AND 1.6.x versio (no CVSS)
- [CVE-2016-0781](https://cve.now/CVE-2016-0781.md): The UAA OAuth approval pages in Cloud Foundry v208 to v231, Login-server v1.6 to v1.14, UAA v2.0.0 to v2.7.4.1, UAA v3.0.0 to v3.2.0, UAA-Re (no CVSS)
- [CVE-2016-0780](https://cve.now/CVE-2016-0780.md): It was discovered that cf-release v231 and lower, Pivotal Cloud Foundry Elastic Runtime 1.5.x versions prior to 1.5.17 and Pivotal Cloud Fou (no CVSS)
- [CVE-2016-0761](https://cve.now/CVE-2016-0761.md): Cloud Foundry Garden-Linux versions prior to v0.333.0 and Elastic Runtime 1.6.x version prior to 1.6.17 contain a flaw in managing container (no CVSS)
- [CVE-2015-3191](https://cve.now/CVE-2015-3191.md): With Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier and Pivotal Cloud Foundry Runtime 1 (no CVSS)
- [CVE-2015-3190](https://cve.now/CVE-2015-3190.md): With Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier and Pivotal Cloud Foundry Runtime 1 (no CVSS)
- [CVE-2015-3189](https://cve.now/CVE-2015-3189.md): With Cloud Foundry Runtime cf-release versions v208 or earlier, UAA Standalone versions 2.2.5 or earlier and Pivotal Cloud Foundry Runtime 1 (no CVSS)
- [CVE-2015-1834](https://cve.now/CVE-2015-1834.md): A path traversal vulnerability was identified in the Cloud Foundry component Cloud Controller that affects cf-release versions prior to v208 (no CVSS)
- [CVE-2014-3527](https://cve.now/CVE-2014-3527.md): When using the CAS Proxy ticket authentication from Spring Security 3.1 to 3.2.4 a malicious CAS Service could trick another CAS Service int (no CVSS)
- [CVE-2014-0225](https://cve.now/CVE-2014-0225.md): When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions (no CVSS)
- [CVE-2014-0097](https://cve.now/CVE-2014-0097.md): The ActiveDirectoryLdapAuthenticator in Spring Security 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length. (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/pivotal
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.