IDCVSSSummaryLast (major) updatePublished
CVE-2020-5400 4.0
Cloud Foundry Cloud Controller (CAPI), versions prior to 1.91.0, logs properties of background jobs when they are run, which may include sensitive information such as credentials if provided to the job. A malicious user with access to those logs may
17-08-2021 - 15:30 27-02-2020 - 20:15
CVE-2020-5417 6.5
Cloud Foundry CAPI (Cloud Controller), versions prior to 1.97.0, when used in a deployment where an app domain is also the system domain (which is true in the default CF Deployment manifest), were vulnerable to developers maliciously or accidentally
17-08-2021 - 15:30 21-08-2020 - 22:15
CVE-2019-11294 4.0
Cloud Foundry Cloud Controller API (CAPI), version 1.88.0, allows space developers to list all global service brokers, including service broker URLs and GUIDs, which should only be accessible to admins.
17-08-2021 - 15:30 19-12-2019 - 20:15
CVE-2019-11282 4.0
Cloud Foundry UAA, versions prior to v74.3.0, contains an endpoint that is vulnerable to SCIM injection attack. A remote authenticated malicious user with scim.invite scope can craft a request with malicious content which can leak information about u
17-08-2021 - 14:29 23-10-2019 - 16:15
CVE-2019-11283 4.0
Cloud Foundry SMB Volume, versions prior to v2.0.3, accidentally outputs sensitive information to the logs. A remote user with access to the SMB Volume logs can discover the username and password for volumes that have been recently created, allowing
17-08-2021 - 14:29 23-10-2019 - 16:15
CVE-2018-1265 6.5
Cloud Foundry Diego, release versions prior to 2.8.0, does not properly sanitize file paths in tar and zip files headers. A remote attacker with CF admin privileges can upload a malicious buildpack that will allow a complete takeover of a Diego Cell
17-08-2021 - 14:29 06-06-2018 - 20:29
CVE-2021-22001 5.0
In UAA versions prior to 75.3.0, sensitive information like relaying secret of the provider was revealed in response when deletion request of an identity provider( IdP) of type “oauth 1.0” was sent to UAA server.
04-08-2021 - 16:14 22-07-2021 - 14:15
CVE-2021-22098 5.8
UAA server versions prior to 75.4.0 are vulnerable to an open redirect vulnerability. A malicious user can exploit the open redirect vulnerability by social engineering leading to take over of victims’ accounts in certain cases along with redirection
19-08-2021 - 19:39 11-08-2021 - 21:15
Back to Top Mark selected
Back to Top