CO
Product
Concourse
7
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 1High 3Medium 3Low 0
Watch
Add Concourse to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-5415 | 10.0 | Aug 12 | Concourse, versions prior to 6.3.1 and 6.4.1, in installations which use the GitLab auth connector, is vulnerable to identity spoofing by way of configuring a GitLab account with… Affected: before 6.3.1; 6.4.0 before 6.4.1 |
| CVE-2019-3792 | 7.5 | Apr 1 | Pivotal Concourse version 5.0.0, contains an API that is vulnerable to SQL injection Affected: before 5.0.1 |
| CVE-2019-3803 | 7.5 | Jan 12 | Concourse includes token in CLI authentication callback Affected: before 4.2.2 |
| CVE-2018-1227 | 7.5 | Mar 13 | Pivotal Concourse after 2018-03-05 might allow remote attackers to have an unspecified impact, if a customer obtained the Concourse software from a DNS domain that is no longer… Affected: 3.9.2 and later |
| CVE-2020-5409 | 6.1 | May 14 | Pivotal Concourse, most versions prior to 6.0.0, allows redirects to untrusted websites in its login flow Affected: before 5.2.8; 5.3.0 before 5.5.10; 5.6.0 before 5.8.1 |
| CVE-2022-31683 | 5.4 | Dec 19 | Concourse (7.x.y prior to 7.8.3 and 6.x.y prior to 6.7.9) contains an authorization bypass issue Affected: 6.0.0 before 6.7.9; 7.0.0 before 7.8.3 |
| CVE-2018-15798 | 5.4 | Dec 19 | Pivotal Concourse Release, versions 4.x prior to 4.2.2, login flow allows redirects to untrusted websites Affected: 4.0.0 before 4.2.2 |
Showing 7