Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
pivotal software vulnerabilities and exploits
(subscribe to this query)
8.8
CVSSv3
CVE-2015-3191
With Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier the change_email form in UAA is vulnerable to a CSRF attack. This allows an malicious user to trigger an e-mail change for a...
Cloudfoundry Cf-release
Pivotal Software Cloud Foundry Elastic Runtime
Pivotal Software Cloud Foundry Uaa
8.8
CVSSv3
CVE-2016-4468
SQL injection vulnerability in Pivotal Cloud Foundry (PCF) prior to 238; UAA 2.x prior to 2.7.4.4, 3.x prior to 3.3.0.2, and 3.4.x prior to 3.4.1; UAA BOSH prior to 11.2 and 12.x prior to 12.2; Elastic Runtime prior to 1.6.29 and 1.7.x prior to 1.7.7; and Ops Manager 1.7.x prior ...
Pivotal Software Cloud Foundry Elastic Runtime 1.6.5
Pivotal Software Cloud Foundry
Pivotal Software Cloud Foundry Elastic Runtime 1.8.0
Pivotal Software Cloud Foundry Uaa
Pivotal Software Cloud Foundry Elastic Runtime 1.6.13
Pivotal Software Cloud Foundry Elastic Runtime 1.7.6
Pivotal Software Cloud Foundry Elastic Runtime 1.6.7
Pivotal Software Cloud Foundry Elastic Runtime 1.6.6
Pivotal Software Cloud Foundry Elastic Runtime 1.7.1
Pivotal Software Cloud Foundry Ops Manager 1.7.3
Pivotal Software Cloud Foundry Ops Manager 1.7.4
Pivotal Software Cloud Foundry Elastic Runtime 1.6.9
Pivotal Software Cloud Foundry Elastic Runtime 1.6.22
Pivotal Software Cloud Foundry Elastic Runtime 1.6.14
Pivotal Software Cloud Foundry Elastic Runtime 1.6.25
Pivotal Software Cloud Foundry Elastic Runtime 1.6.17
Pivotal Software Cloud Foundry Elastic Runtime 1.7.4
Pivotal Software Cloud Foundry Elastic Runtime 1.6.10
Pivotal Software Cloud Foundry Elastic Runtime 1.6.0
Pivotal Software Cloud Foundry Elastic Runtime 1.7.7
Pivotal Software Cloud Foundry Elastic Runtime 1.6.20
Pivotal Software Cloud Foundry Elastic Runtime 1.6.2
8.8
CVSSv3
CVE-2016-6651
The UAA /oauth/token endpoint in Pivotal Cloud Foundry (PCF) prior to 243; UAA 2.x prior to 2.7.4.8, 3.x prior to 3.3.0.6, and 3.4.x prior to 3.4.5; UAA BOSH prior to 11.7 and 12.x prior to 12.6; Elastic Runtime prior to 1.6.40, 1.7.x prior to 1.7.21, and 1.8.x prior to 1.8.2; an...
Pivotal Software Cloud Foundry Ops Manager 1.7.7
Pivotal Software Cloud Foundry Ops Manager 1.7.6
Pivotal Software Cloud Foundry Ops Manager 1.8.0
Pivotal Software Cloud Foundry Elastic Runtime 1.8.0
Pivotal Software Cloud Foundry Elastic Runtime 1.6.33
Pivotal Software Cloud Foundry Elastic Runtime 1.6.32
Pivotal Software Cloud Foundry Elastic Runtime 1.6.31
Pivotal Software Cloud Foundry Elastic Runtime 1.6.23
Pivotal Software Cloud Foundry Elastic Runtime 1.6.22
Pivotal Software Cloud Foundry Elastic Runtime 1.6.14
Pivotal Software Cloud Foundry Elastic Runtime 1.6.13
Pivotal Software Cloud Foundry Elastic Runtime 1.6.5
Pivotal Software Cloud Foundry Elastic Runtime 1.6.4
Pivotal Software Cloud Foundry Elastic Runtime 1.7.18
Pivotal Software Cloud Foundry Elastic Runtime 1.7.17
Pivotal Software Cloud Foundry Elastic Runtime 1.7.10
Pivotal Software Cloud Foundry Elastic Runtime 1.7.9
Pivotal Software Cloud Foundry Elastic Runtime 1.7.1
Pivotal Software Cloud Foundry Elastic Runtime 1.7.0
Pivotal Software Cloud Foundry Ops Manager 1.7.11
Pivotal Software Cloud Foundry Ops Manager 1.7.10
Pivotal Software Cloud Foundry Ops Manager 1.7.3
8.5
CVSSv3
CVE-2018-1197
In Windows Stemcells versions before 1200.14, apps running inside containers in Windows on Google Cloud Platform are able to access the metadata endpoint. A malicious developer could use this access to gain privileged credentials.
Pivotal Software Windows Stemcells
8.1
CVSSv3
CVE-2020-5411
When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jackson fixed this vulnerability by blacklisting known "deserialization gadgets". Spring Batch configures Jackson with global default...
Pivotal Software Spring Batch
8.1
CVSSv3
CVE-2018-15795
Pivotal CredHub Service Broker, versions before 1.1.0, uses a guessable form of random number generation in creating service broker's UAA client. A remote malicious user may guess the client secret and obtain or modify credentials for users of the CredHub Service.
Pivotal Software Credhub Service Broker
8.1
CVSSv3
CVE-2018-15796
Cloud Foundry Bits Service Release, versions before 2.14.0, uses an insecure hashing algorithm to sign URLs. A remote malicious user may obtain a signed URL and extract the signing key, allowing them complete read and write access to the the Bits Service storage.
Pivotal Software Bits Service
8.1
CVSSv3
CVE-2018-15758
Spring Security OAuth, versions 2.3 before 2.3.4, and 2.2 before 2.2.3, and 2.1 before 2.1.3, and 2.0 before 2.0.16, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can craft a request to the app...
Pivotal Software Spring Security Oauth
8.1
CVSSv3
CVE-2017-4963
An issue exists in Cloud Foundry Foundation Cloud Foundry release v252 and previous versions versions, UAA stand-alone release v2.0.0 - v2.7.4.12 & v3.0.0 - v3.11.0, and UAA bosh release v26 & earlier versions. UAA is vulnerable to session fixation when configured to auth...
Pivotal Software Cloud Foundry Uaa
Pivotal Software Cloud Foundry Uaa-release
Pivotal Software Cloud Foundry Cf-release
1 Github repository
8.1
CVSSv3
CVE-2016-3084
The UAA reset password flow in Cloud Foundry release v236 and previous versions versions, UAA release v3.3.0 and previous versions versions, all versions of Login-server, UAA release v10 and previous versions versions and Pivotal Elastic Runtime versions before 1.7.2 is vulnerabl...
Pivotal Software Login-server -
Cloudfoundry Cloud Foundry Uaa Bosh
Pivotal Software Cloud Foundry Elastic Runtime
Pivotal Software Cloud Foundry Uaa
Pivotal Software Cloud Foundry
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-21111
CVE-2024-32884
IDOR
CVE-2023-1000
CVE-2024-33260
CVE-2024-3682
reflected XSS
race condition
CVE-2024-3400
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
7
8
9
10
NEXT »