Vulnerabilities > Cloudfoundry
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2018-05-23 | CVE-2018-1193 | Unspecified vulnerability in Cloudfoundry Routing-Release Cloud Foundry routing-release, versions prior to 0.175.0, lacks sanitization for user-provided X-Forwarded-Proto headers. | 5.3 |
| 2018-05-15 | CVE-2018-1262 | Cloud Foundry Foundation UAA, versions 4.12.X and 4.13.X, introduced a feature which could allow privilege escalation across identity zones for clients performing offline validation. | 7.2 |
| 2018-04-30 | CVE-2018-1277 | Resource Exhaustion vulnerability in Cloudfoundry Cf-Deployment and Garden-Runc Cloud Foundry Garden-runC, versions prior to 1.13.0, does not correctly enforce disc quotas for Docker image layers. | 6.5 |
| 2018-04-18 | CVE-2016-2169 | Code vulnerability in Cloudfoundry Capi-Release and Cf-Release Cloud Foundry Cloud Controller, capi-release versions prior to 1.0.0 and cf-release versions prior to v237, contain a business logic flaw. | 5.3 |
| 2018-03-29 | CVE-2016-6658 | Information Exposure vulnerability in multiple products Applications in cf-release before 245 can be configured and pushed with a user-provided custom buildpack using a URL pointing to the buildpack. | 9.6 |
| 2018-03-29 | CVE-2018-1191 | Information Exposure vulnerability in Cloudfoundry Cf-Deployment and Garden-Runc-Release Cloud Foundry Garden-runC, versions prior to 1.11.0, contains an information exposure vulnerability. | 8.8 |
| 2018-03-27 | CVE-2018-1267 | Incorrect Permission Assignment for Critical Resource vulnerability in Cloudfoundry Silk-Release 0.1.0 Cloud Foundry Silk CNI plugin, versions prior to 0.2.0, contains an improper access control vulnerability. | 8.1 |
| 2018-03-27 | CVE-2018-1266 | Use of Insufficiently Random Values vulnerability in Cloudfoundry Capi-Release Cloud Foundry Cloud Controller, versions prior to 1.52.0, contains information disclosure and path traversal vulnerabilities. | 8.1 |
| 2018-03-19 | CVE-2018-1221 | Improper Input Validation vulnerability in Cloudfoundry Cf-Deployment In cf-deployment before 1.14.0 and routing-release before 0.172.0, the Cloud Foundry Gorouter mishandles WebSocket requests for AWS Application Load Balancers (ALBs) and some other HTTP-aware Load Balancers. | 8.1 |
| 2018-03-19 | CVE-2018-1195 | Insufficient Session Expiration vulnerability in Cloudfoundry Cf-Release In Cloud Controller versions prior to 1.46.0, cf-deployment versions prior to 1.3.0, and cf-release versions prior to 283, Cloud Controller accepts refresh tokens for authentication where access tokens are expected. | 8.8 |