Pivotal Software - vulnerabilities (CVEs)

143 CVEs in 57 products, 0 in the last 30 days, newest from 2024-03-18.

Products

Cloud Foundry Uaa - 32 CVEs
Cloud Foundry Elastic Runtime - 28 CVEs
Rabbitmq - 11 CVEs
Spring Framework - 11 CVEs
Cloud Foundry - 10 CVEs
Operations Manager - 10 CVEs
Cloud Foundry Uaa-release - 8 CVEs
Concourse - 7 CVEs
Pivotal Application Service - 7 CVEs
Cloud Foundry Ops Manager - 5 CVEs
Spring Security - 5 CVEs
Application Service - 4 CVEs
Spring Data Rest - 4 CVEs
Spring Security Oauth - 4 CVEs
Cloud Foundry Cf - 3 CVEs
Cloud Foundry Cf-deployment - 2 CVEs
Cloud Foundry Cf-release - 2 CVEs
Cloudfoundry Uaa Release - 2 CVEs
Gemfire For Pivotal Cloud Foundry - 2 CVEs
Login-server - 2 CVEs
Pivotal Container Service - 2 CVEs
Spring Advanced Message Queuing Protocol - 2 CVEs
Spring Batch Admin - 2 CVEs
Windows Stemcells - 2 CVEs
Bits Service - 1 CVEs
Bosh Cli - 1 CVEs
Broker Api - 1 CVEs
Cf-deployment - 1 CVEs
Cloud Foundry Cf Mysql - 1 CVEs
Cloud Foundry Diego - 1 CVEs
Cloud Foundry Log Cache - 1 CVEs
Cloud Foundry Nfs Volume - 1 CVEs
Cloud Foundry Smb Volume - 1 CVEs
Cloudfoundry Uaa - 1 CVEs
Credhub-release - 1 CVEs
Credhub Service Broker - 1 CVEs
Gemfire - 1 CVEs
Greenplum - 1 CVEs
Greenplum Command Center - 1 CVEs
Grootfs - 1 CVEs
On Demand Services Sdk - 1 CVEs
Pivotal Cloud Cache - 1 CVEs
Rabbitmq Management - 1 CVEs
Spring-ldap - 1 CVEs
Spring Data Java Persistance Api - 1 CVEs
Spring Data Java Persistence Api - 1 CVEs
Spring Data Jpa - 1 CVEs
Cloud Foundry Php Buildpack - 0 CVEs
Cloud Foundry Uaa Bosh - 0 CVEs
Cloud Foundry Uaa Release - 0 CVEs
Redis - 0 CVEs
Spring Batch - 0 CVEs
Spring Boot - 0 CVEs
Spring Data Commons - 0 CVEs
Spring Integration - 0 CVEs
Spring Ldap - 0 CVEs
Spring Web Services - 0 CVEs

Newest CVEs of Pivotal Software

CVE-2024-22257 - CVSS 8.2 (high), 2024-03-18: In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, versions 6.2.x prior…
CVE-2024-22243 - CVSS 8.1 (high), 2024-02-23: Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of…
CVE-2022-31683 - CVSS 5.4 (medium), 2022-12-19: Concourse (7.x.y prior to 7.8.3 and 6.x.y prior to 6.7.9) contains an authorization bypass issue. A Concourse user can send a request with body including…
CVE-2021-22112 - CVSS 8.8 (high), 2021-02-23: Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the…
CVE-2020-5419 - CVSS 6.7 (medium), 2020-08-31: RabbitMQ versions 3.8.x prior to 3.8.7 are prone to a Windows-specific binary planting security vulnerability that allows for arbitrary code execution. An…
CVE-2020-5415 - CVSS 10 (critical), 2020-08-12: Concourse, versions prior to 6.3.1 and 6.4.1, in installations which use the GitLab auth connector, is vulnerable to identity spoofing by way of configuring a…
CVE-2020-5408 - CVSS 6.5 (medium), 2020-05-14: Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null…
CVE-2020-5409 - CVSS 7.6 (high), 2020-05-14: Pivotal Concourse, most versions prior to 6.0.0, allows redirects to untrusted websites in its login flow. A remote unauthenticated attacker could convince a…
CVE-2020-5407 - CVSS 8.8 (high), 2020-05-13: Spring Security versions 5.2.x prior to 5.2.4 and 5.3.x prior to 5.3.2 contain a signature wrapping vulnerability during SAML response validation. When using…
CVE-2020-5399 - CVSS 7.6 (high), 2020-02-12: Cloud Foundry CredHub, versions prior to 2.5.10, connects to a MySQL database without TLS even when configured to use TLS. A malicious user with access to the…
CVE-2013-6430 - CVSS 5.4 (medium), 2020-01-10: The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain…
CVE-2019-11292 - CVSS 8.8 (high), 2020-01-09: Pivotal Ops Manager, versions 2.4.x prior to 2.4.27, 2.5.x prior to 2.5.24, 2.6.x prior to 2.6.16, and 2.7.x prior to 2.7.5, logs all query parameters to…
CVE-2019-11287 - CVSS 7.5 (high), 2019-11-23: Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x…
CVE-2019-11282 - CVSS 4.3 (medium), 2019-10-23: Cloud Foundry UAA, versions prior to v74.3.0, contains an endpoint that is vulnerable to SCIM injection attack. A remote authenticated malicious user with…
CVE-2019-11283 - CVSS 8.8 (high), 2019-10-23: Cloud Foundry SMB Volume, versions prior to v2.0.3, accidentally outputs sensitive information to the logs. A remote user with access to the SMB Volume logs…
CVE-2019-11281 - CVSS 4.8 (medium), 2019-10-16: Pivotal RabbitMQ, versions prior to v3.7.18, and RabbitMQ for PCF, versions 1.15.x prior to 1.15.13, versions 1.16.x prior to 1.16.6, and versions 1.17.x…
CVE-2019-11275 - CVSS 4.3 (medium), 2019-10-01: Pivotal Application Manager, versions 666.0.x prior to 666.0.36, versions 667.0.x prior to 667.0.22, versions 668.0.x prior to 668.0.21, versions 669.0.x…
CVE-2019-11280 - CVSS 8.8 (high), 2019-09-20: Pivotal Apps Manager, included in Pivotal Application Service versions 2.3.x prior to 2.3.18, 2.4.x prior to 2.4.14, 2.5.x prior to 2.5.10, and 2.6.x prior to…
CVE-2019-11276 - CVSS 5.4 (medium), 2019-08-19: Pivotal Apps Manager, included in Pivotal Application Service versions 2.3.x prior to 2.3.16, 2.4.x prior to 2.4.12, 2.5.x prior to 2.5.8, and 2.6.x prior to…
CVE-2019-11270 - CVSS 7.5 (high), 2019-08-05: Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or scope can bypass the…
CVE-2019-11273 - CVSS 4.3 (medium), 2019-07-23: Pivotal Container Services (PKS) versions 1.3.x prior to 1.3.7, and versions 1.4.x prior to 1.4.1, contains a vulnerable component which logs the username and…
CVE-2019-3794 - CVSS 6.5 (medium), 2019-07-18: Cloud Foundry UAA, versions prior to v73.4.0, does not set an X-FRAME-OPTIONS header on various endpoints. A remote user can perform clickjacking attacks on…
CVE-2019-11268 - CVSS 6.5 (medium), 2019-07-11: Cloud Foundry UAA version prior to 73.3.0, contain endpoints that contains improper escaping. An authenticated malicious user with basic read privileges for…
CVE-2019-3787 - CVSS 8.8 (high), 2019-06-19: Cloud Foundry UAA, versions prior to 73.0.0, falls back to appending “unknown.org” to a user's email address when one is not provided and the user name does…
CVE-2019-11269 - CVSS 5.4 (medium), 2019-06-12: Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsupported versions…
CVE-2019-3790 - CVSS 6.1 (medium), 2019-06-06: The Pivotal Ops Manager, 2.2.x versions prior to 2.2.23, 2.3.x versions prior to 2.3.16, 2.4.x versions prior to 2.4.11, and 2.5.x versions prior to 2.5.3,…
CVE-2019-3802 - CVSS 5.3 (medium), 2019-06-03: This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING,…
CVE-2019-3797 - CVSS 5.3 (medium), 2019-05-06: This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ‘startingWith’,…
CVE-2019-3793 - CVSS 9.8 (critical), 2019-04-24: Pivotal Apps Manager Release, versions 665.0.x prior to 665.0.28, versions 666.0.x prior to 666.0.21, versions 667.0.x prior to 667.0.7, contain an invitation…
CVE-2019-3792 - CVSS 7.5 (high), 2019-04-01: Pivotal Concourse version 5.0.0, contains an API that is vulnerable to SQL injection. An Concourse resource can craft a version identifier that can carry a…