CF
Product
Cloud Foundry Uaa
32
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 18Medium 9Low 1
Watch
Add Cloud Foundry Uaa to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2015-5172 | 9.8 | Oct 24 | Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by… Affected: before 2.5.2 |
| CVE-2015-5171 | 9.8 | Oct 24 | The password change functionality in Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to… Affected: before 2.5.2 |
| CVE-2017-4992 | 9.8 | Jun 13 | An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v261; UAA release 2.x versions prior to v2.7.4.17, 3.6.x versions prior to v3.6.11, 3.9.x versions… Affected: through 4.2.0; 2.2.5.4; 2.7.1; 2.7.2; 2.7.3; 2.7.4; +34 more |
| CVE-2016-6637 | 9.6 | Sep 30 | Multiple cross-site request forgery (CSRF) vulnerabilities in Pivotal Cloud Foundry (PCF) before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x before 3.4.4; UAA BOSH… Affected: 2.3.0; 2.3.1; 2.4.0; 2.5.1; 2.6.1; 2.7.0.2; +15 more |
| CVE-2018-15761 | 8.8 | Nov 19 | Cloud Foundry UAA release, versions prior to v64.0, and UAA, versions prior to 4.23.0, contains a validation error which allows for privilege escalation Affected: before 4.23.0 |
| CVE-2018-1192 | 8.8 | Feb 1 | In Cloud Foundry Foundation cf-release versions prior to v285; cf-deployment versions prior to v1.7; UAA 4.5.x versions prior to 4.5.5, 4.8.x versions prior to 4.8.3, and 4.7.x… Affected: 4.5.0 before 4.5.5; 4.7.0 before 4.7.4; 4.8.0 before 4.8.3 |
| CVE-2015-5173 | 8.8 | Oct 24 | Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact via vectors… Affected: before 2.5.2 |
| CVE-2015-5170 | 8.8 | Oct 24 | Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow remote attackers to conduct cross-site request… Affected: before 2.5.2 |
| CVE-2017-4973 | 8.8 | Jun 13 | An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v257; UAA release 2.x versions prior to v2.7.4.14, 3.6.x versions prior to v3.6.8, 3.9.x versions… Affected: 2.2.5.4; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.4.1; +29 more |
| CVE-2015-3191 | 8.8 | May 25 | With Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier the change_email form… Affected: through 2.2.6 |
| CVE-2016-4468 | 8.8 | Apr 11 | SQL injection vulnerability in Pivotal Cloud Foundry (PCF) before 238; UAA 2.x before 2.7.4.4, 3.x before 3.3.0.2, and 3.4.x before 3.4.1; UAA BOSH before 11.2 and 12.x before… Affected: through 3.4.0 |
| CVE-2016-6651 | 8.8 | Sep 30 | The UAA /oauth/token endpoint in Pivotal Cloud Foundry (PCF) before 243; UAA 2.x before 2.7.4.8, 3.x before 3.3.0.6, and 3.4.x before 3.4.5; UAA BOSH before 11.7 and 12.x before… Affected: through 3.7.0 |
| CVE-2017-4963 | 8.1 | Jun 13 | An issue was discovered in Cloud Foundry Foundation Cloud Foundry release v252 and earlier versions, UAA stand-alone release v2.0.0 - v2.7.4.12 & v3.0.0 - v3.11.0, and UAA bosh… Affected: 2.0.0 through 2.7.4.12; 3.0.0 through 3.11.0 |
| CVE-2016-3084 | 8.1 | May 25 | The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA release v10 and earlier… Affected: through 3.3.0 |
| CVE-2016-6659 | 8.1 | Dec 23 | Cloud Foundry before 248; UAA 2.x before 2.7.4.12, 3.x before 3.6.5, and 3.7.x through 3.9.x before 3.9.3; and UAA bosh release (aka uaa-release) before 13.9 for UAA 3.6.5 and… Affected: through 3.9.2 |
| CVE-2019-11270 | 7.5 | Aug 5 | Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or scope can bypass the restrictions imposed… Affected: before 73.4.0 |
| CVE-2018-11047 | 7.5 | Jul 24 | Cloud Foundry UAA, versions 4.19 prior to 4.19.2 and 4.12 prior to 4.12.4 and 4.10 prior to 4.10.2 and 4.7 prior to 4.7.6 and 4.5 prior to 4.5.7, incorrectly authorizes requests… Affected: 4.5.0 before 4.5.7; 4.7.0 before 4.7.6; 4.10.0 before 4.10.2; 4.12.0 before 4.12.4; 4.19.0 before 4.19.2 |
| CVE-2017-4994 | 7.5 | Jun 13 | An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v263; UAA release 2.x versions prior to v2.7.4.18, 3.6.x versions prior to v3.6.12, 3.9.x versions… Affected: through 4.2.0; 2.2.5.4; 2.7.1; 2.7.2; 2.7.3; 2.7.4; +34 more |
| CVE-2017-4972 | 7.5 | Jun 13 | An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v257; UAA release 2.x versions prior to v2.7.4.14, 3.6.x versions prior to v3.6.8, 3.9.x versions… Affected: through 3.15.0; 2.2.5.4; 2.7.1; 2.7.2; 2.7.3; 2.7.4; +32 more |
| CVE-2017-4960 | 7.5 | Mar 10 | An issue was discovered in Cloud Foundry release v247 through v252, UAA stand-alone release v3.9.0 through v3.11.0, and UAA Bosh Release v21 through v26 Affected: 3.9.0; 3.9.1; 3.9.2; 3.9.3; 3.9.4; 3.9.5; +5 more |
| CVE-2018-1262 | 7.2 | May 15 | Cloud Foundry Foundation UAA, versions 4.12.X and 4.13.X, introduced a feature which could allow privilege escalation across identity zones for clients performing offline… Affected: 4.12.0; 4.12.1; 4.12.2; 4.13.0; 4.13.1; 4.13.2; +2 more |
| CVE-2017-4991 | 7.2 | Jun 13 | An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v260; UAA release 2.x versions prior to v2.7.4.16, 3.6.x versions prior to v3.6.10, 3.9.x versions… Affected: through 4.2.0; 2.2.5.4; 2.7.1; 2.7.2; 2.7.3; 2.7.4; +32 more |
| CVE-2017-8032 | 6.6 | Jul 10 | In Cloud Foundry cf-release versions prior to v264; UAA release all versions of UAA v2.x.x, 3.6.x versions prior to v3.6.13, 3.9.x versions prior to v3.9.15, 3.20.x versions prior… Affected: 2.2.5.4; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.4.1; +34 more |
| CVE-2017-4974 | 6.5 | Jun 13 | An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v258; UAA release 2.x versions prior to v2.7.4.15, 3.6.x versions prior to v3.6.9, 3.9.x versions… Affected: through 4.2.0; 2.2.5.4; 2.7.1; 2.7.2; 2.7.3; 2.7.4; +33 more |
| CVE-2018-11041 | 6.1 | Jun 25 | Cloud Foundry UAA, versions later than 4.6.0 and prior to 4.19.0 except 4.10.1 and 4.7.5 and uaa-release versions later than v48 and prior to v60 except v55.1 and v52.9, does not… Affected: after 4.6.0 before 4.7.5; after 4.7.5 before 4.10.1; after 4.10.1 before 4.19.0 |
| CVE-2016-0781 | 6.1 | May 25 | The UAA OAuth approval pages in Cloud Foundry v208 to v231, Login-server v1.6 to v1.14, UAA v2.0.0 to v2.7.4.1, UAA v3.0.0 to v3.2.0, UAA-Release v2 to v7 and Pivotal Elastic… Affected: through 2.7.4.1; 3.0.0; 3.0.1; 3.1.0; 3.2.0 |
| CVE-2015-3190 | 6.1 | May 25 | With Cloud Foundry Runtime cf-release versions v209 or earlier, UAA Standalone versions 2.2.6 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier the UAA logout link is… Affected: through 2.2.6 |
| CVE-2016-5016 | 5.9 | Apr 24 | Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server) 3.4.1 and earlier, UAA release 12.2 and earlier, PCF (aka Pivotal Cloud Foundry) Elastic… Affected: through 3.4.1 |
| CVE-2019-3794 | 5.4 | Jul 18 | Cloud Foundry UAA, versions prior to v73.4.0, does not set an X-FRAME-OPTIONS header on various endpoints Affected: before 73.4.0 |
| CVE-2016-6636 | 5.3 | Sep 30 | The OAuth authorization implementation in Pivotal Cloud Foundry (PCF) before 242; UAA 2.x before 2.7.4.7, 3.x before 3.3.0.5, and 3.4.x before 3.4.4; UAA BOSH before 11.5 and 12.x… Affected: 2.3.0; 2.3.1; 2.4.0; 2.5.1; 2.6.1; 2.7.0.2; +15 more |
| CVE-2019-11282 | 4.3 | Oct 23 | Cloud Foundry UAA, versions prior to v74.3.0, contains an endpoint that is vulnerable to SCIM injection attack Affected: before 74.3.0 |
| CVE-2015-3189 | 3.7 | May 25 | With Cloud Foundry Runtime cf-release versions v208 or earlier, UAA Standalone versions 2.2.5 or earlier and Pivotal Cloud Foundry Runtime 1.4.5 or earlier, old Password Reset… Affected: through 2.2.5 |
Showing 32