CF
Product
Cloud Foundry Elastic Runtime
28
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 8High 10Medium 9Low 1
Watch
Add Cloud Foundry Elastic Runtime to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2015-5172 | 9.8 | Oct 24 | Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by… Affected: before 1.7.0 |
| CVE-2015-5171 | 9.8 | Oct 24 | The password change functionality in Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to… Affected: before 1.7.0 |
| CVE-2017-4955 | 9.8 | Jun 13 | An issue was discovered in Pivotal PCF Elastic Runtime 1.6.x versions prior to 1.6.65, 1.7.x versions prior to 1.7.48, 1.8.x versions prior to 1.8.28, and 1.9.x versions prior to… Affected: 1.6.0; 1.6.1; 1.6.2; 1.6.3; 1.6.4; 1.6.5; +34 more |
| CVE-2017-2773 | 9.8 | Jun 13 | An issue was discovered in Pivotal PCF Elastic Runtime 1.6.x versions prior to 1.6.60, 1.7.x versions prior to 1.7.41, 1.8.x versions prior to 1.8.23, and 1.9.x versions prior to… Affected: 1.6.0; 1.6.1; 1.6.2; 1.6.3; 1.6.4; 1.6.5; +34 more |
| CVE-2016-0761 | 9.8 | May 25 | Cloud Foundry Garden-Linux versions prior to v0.333.0 and Elastic Runtime 1.6.x version prior to 1.6.17 contain a flaw in managing container files during Docker image preparation… Affected: 1.6.0; 1.6.1; 1.6.2; 1.6.3; 1.6.4; 1.6.5; +11 more |
| CVE-2016-5006 | 9.8 | May 2 | The Cloud Controller in Cloud Foundry before 239 logs user-provided service objects at creation, which allows attackers to obtain sensitive user credential information via… Affected: through 1.6.32; 1.7.0; 1.7.1; 1.7.2; 1.7.3; 1.7.4; +6 more |
| CVE-2016-6658 | 9.6 | Mar 29 | Applications in cf-release before 245 can be configured and pushed with a user-provided custom buildpack using a URL pointing to the buildpack Affected: before 1.6.49; 1.7.0 before 1.7.31; 1.8.0 before 1.8.11 |
| CVE-2016-6637 | 9.6 | Sep 30 | Multiple cross-site request forgery (CSRF) vulnerabilities in Pivotal Cloud Foundry (PCF) before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x before 3.4.4; UAA BOSH… Affected: 1.6.0; 1.6.1; 1.6.2; 1.6.3; 1.6.4; 1.6.5; +34 more |
| CVE-2015-5173 | 8.8 | Oct 24 | Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact via vectors… Affected: before 1.7.0 |
| CVE-2015-5170 | 8.8 | Oct 24 | Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow remote attackers to conduct cross-site request… Affected: before 1.7.0 |
| CVE-2017-4959 | 8.8 | Jun 13 | An issue was discovered in Pivotal PCF Elastic Runtime 1.8.x versions prior to 1.8.29 and 1.9.x versions prior to 1.9.7 Affected: 1.8.0; 1.8.1; 1.8.2; 1.8.3; 1.8.4; 1.8.5; +30 more |
| CVE-2015-3191 | 8.8 | May 25 | With Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier the change_email form… Affected: through 1.4.5 |
| CVE-2016-4468 | 8.8 | Apr 11 | SQL injection vulnerability in Pivotal Cloud Foundry (PCF) before 238; UAA 2.x before 2.7.4.4, 3.x before 3.3.0.2, and 3.4.x before 3.4.1; UAA BOSH before 11.2 and 12.x before… Affected: 1.6.0; 1.6.1; 1.6.2; 1.6.3; 1.6.4; 1.6.5; +30 more |
| CVE-2016-6651 | 8.8 | Sep 30 | The UAA /oauth/token endpoint in Pivotal Cloud Foundry (PCF) before 243; UAA 2.x before 2.7.4.8, 3.x before 3.3.0.6, and 3.4.x before 3.4.5; UAA BOSH before 11.7 and 12.x before… Affected: 1.6.0; 1.6.1; 1.6.2; 1.6.3; 1.6.4; 1.6.5; +34 more |
| CVE-2016-3084 | 8.1 | May 25 | The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA release v10 and earlier… Affected: through 1.7.1 |
| CVE-2016-0780 | 7.5 | May 25 | It was discovered that cf-release v231 and lower, Pivotal Cloud Foundry Elastic Runtime 1.5.x versions prior to 1.5.17 and Pivotal Cloud Foundry Elastic Runtime 1.6.x versions… Affected: 1.5.0; 1.5.1; 1.5.2; 1.5.3; 1.5.4; 1.5.5; +29 more |
| CVE-2016-6657 | 7.4 | Dec 16 | An open redirect vulnerability has been detected with some Pivotal Cloud Foundry Elastic Runtime components Affected: 1.8.0; 1.8.1; 1.8.2; 1.8.3; 1.8.4; 1.8.5; +7 more |
| CVE-2016-0896 | 7.3 | Sep 18 | Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.34 and 1.7.x before 1.7.12 places 169.254.0.0/16 in the all_open Application Security Group, which might allow remote… Affected: through 1.6.33; 1.7.0; 1.7.1; 1.7.2; 1.7.3; 1.7.4; +7 more |
| CVE-2016-2165 | 6.5 | May 25 | The Loggregator Traffic Controller endpoints in cf-release v231 and lower, Pivotal Elastic Runtime versions prior to 1.5.19 AND 1.6.x versions prior to 1.6.20 are not cleansing… Affected: through 1.5.18; 1.6.0; 1.6.1; 1.6.2; 1.6.3; 1.6.4; +15 more |
| CVE-2015-1834 | 6.5 | May 25 | A path traversal vulnerability was identified in the Cloud Foundry component Cloud Controller that affects cf-release versions prior to v208 and Pivotal Cloud Foundry Elastic… Affected: through 1.4.1 |
| CVE-2016-0781 | 6.1 | May 25 | The UAA OAuth approval pages in Cloud Foundry v208 to v231, Login-server v1.6 to v1.14, UAA v2.0.0 to v2.7.4.1, UAA v3.0.0 to v3.2.0, UAA-Release v2 to v7 and Pivotal Elastic… Affected: 1.6.0; 1.6.1; 1.6.2; 1.6.3; 1.6.4; 1.6.5; +14 more |
| CVE-2015-3190 | 6.1 | May 25 | With Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier the UAA logout link is… Affected: through 1.4.5 |
| CVE-2016-0927 | 6.1 | Sep 18 | Cross-site scripting (XSS) vulnerability in Pivotal Cloud Foundry (PCF) Ops Manager before 1.6.17 allows remote attackers to inject arbitrary web script or HTML via unspecified… Affected: 1.6.0; 1.6.1; 1.6.2; 1.6.3; 1.6.4; 1.6.5; +10 more |
| CVE-2016-0926 | 6.1 | Sep 18 | Cross-site scripting (XSS) vulnerability in Apps Manager in Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.32 and 1.7.x before 1.7.8 allows remote attackers to inject… Affected: 1.6.0 before 1.6.32; 1.7.0 before 1.7.8 |
| CVE-2016-0715 | 5.9 | Sep 11 | Pivotal Cloud Foundry Elastic Runtime version 1.4.0 through 1.4.5, 1.5.0 through 1.5.11 and 1.6.0 through 1.6.11 is vulnerable to a remote information disclosure Affected: 1.4.0 through 1.4.5; 1.5.0 through 1.5.11; 1.6.0 through 1.6.11 |
| CVE-2016-5016 | 5.9 | Apr 24 | Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server) 3.4.1 and earlier, UAA release 12.2 and earlier, PCF (aka Pivotal Cloud Foundry) Elastic… Affected: 1.6.0 before 1.6.35; 1.7.0 before 1.7.13 |
| CVE-2016-6636 | 5.3 | Sep 30 | The OAuth authorization implementation in Pivotal Cloud Foundry (PCF) before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x before 3.4.4; UAA BOSH before 11.5 and 12.x… Affected: 1.6.0; 1.6.1; 1.6.2; 1.6.3; 1.6.4; 1.6.5; +34 more |
| CVE-2015-3189 | 3.7 | May 25 | With Cloud Foundry Runtime cf-release versions v208 or earlier, UAA Standalone versions 2.2.5 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier, old Password Reset… Affected: through 1.4.5 |
Showing 28