CF
Product
Cf-deployment
37
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 18Medium 17Low 0
Watch
Add Cf-deployment to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-22723 | 6.5 | Mar 5 | UAA User Token Revocation logic error Affected: after 48.7.0 through 54.11.0 |
| CVE-2021-22115 | 6.5 | Apr 8 | Cloud Controller API versions prior to 1.106.0 logs service broker credentials if the default value of db logging config field is changed Affected: before 16.2.0 |
| CVE-2020-5416 | 6.5 | Aug 21 | Cloud Foundry Routing (Gorouter), versions prior to 0.204.0, when used in a deployment with NGINX reverse proxies in front of the Gorouters, is potentially vulnerable to… Affected: before 13.13.0 |
| CVE-2020-5400 | 6.5 | Feb 27 | Cloud Foundry Cloud Controller (CAPI), versions prior to 1.91.0, logs properties of background jobs when they are run, which may include sensitive information such as credentials… Affected: before 12.33.0 |
| CVE-2019-11293 | 6.5 | Dec 6 | Cloud Foundry UAA Release, versions prior to v74.10.0, when set to logging level DEBUG, logs client_secret credentials when sent as a query parameter Affected: before 12.12.0 |
| CVE-2018-1277 | 6.5 | Apr 30 | Cloud Foundry Garden-runC, versions prior to 1.13.0, does not correctly enforce disc quotas for Docker image layers Affected: before 1.28.0 |
| CVE-2017-14389 | 6.5 | Nov 28 | An issue was discovered in Cloud Foundry Foundation capi-release (all versions prior to 1.45.0), cf-release (all versions prior to v280), and cf-deployment (all versions prior to… Affected: before 1.0.0 |
| CVE-2021-22098 | 6.1 | Aug 11 | UAA server versions prior to 75.4.0 are vulnerable to an open redirect vulnerability Affected: before 16.20.0 |
| CVE-2023-20882 | 5.9 | May 26 | In Cloud foundry routing release versions from 0.262.0 and prior to 0.266.0,a bug in the gorouter process can lead to a denial of service of applications hosted on Cloud Foundry Affected: 27.4.0 before 29.0.0 |
| CVE-2020-15586 | 5.9 | Jul 17 | Go before 1.13.13 and 1.14.x before 1.14.5 has a data race in some net/http servers, as demonstrated by the httputil.ReverseProxy Handler, because it reads a request body and… Affected: before 13.7.0 |
| CVE-2023-34041 | 5.3 | Sep 8 | Cloud foundry routing release versions prior to 0.278.0 are vulnerable to abuse of HTTP Hop-by-Hop Headers Affected: before 32.4.0 |
| CVE-2021-22100 | 5.3 | Mar 25 | In cloud foundry CAPI versions prior to 1.122, a denial-of-service attack in which a developer can push a service broker that (accidentally or maliciously) causes CC instances to… Affected: before 17.1.0 |
| CVE-2018-1193 | 5.3 | May 23 | Cloud Foundry routing-release, versions prior to 0.175.0, lacks sanitization for user-provided X-Forwarded-Proto headers Affected: before 1.27.0 |
| CVE-2026-22726 | 5.0 | Apr 30 | Route Services Firewall Bypass Affected: 0.0.2 before 55.0.0 |
| CVE-2020-5418 | 4.3 | Sep 3 | Cloud Foundry CAPI (Cloud Controller) versions prior to 1.98.0 allow authenticated users having only the "cloud_controller.read" scope, but no roles in any spaces, to list all… Affected: before 13.17.0 |
| CVE-2019-11294 | 4.3 | Dec 19 | Cloud Foundry Cloud Controller API (CAPI), version 1.88.0, allows space developers to list all global service brokers, including service broker URLs and GUIDs, which should only… Affected: before 12.7.0 |
| CVE-2019-11282 | 4.3 | Oct 23 | Cloud Foundry UAA, versions prior to v74.3.0, contains an endpoint that is vulnerable to SCIM injection attack Affected: before 12.2.0 |
Showing 17