Vulnerabilities > Pivotal

DATE CVE VULNERABILITY TITLE RISK
2020-03-20 CVE-2019-19029 SQL Injection vulnerability in multiple products
Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via user-groups in the VMware Harbor Container Registry for the Pivotal Platform.
network
low complexity
linuxfoundation pivotal CWE-89
6.5
2020-03-20 CVE-2019-19026 SQL Injection vulnerability in multiple products
Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via project quotas in the VMware Harbor Container Registry for the Pivotal Platform.
network
low complexity
linuxfoundation pivotal CWE-89
4.0
2020-03-20 CVE-2019-19025 Cross-Site Request Forgery (CSRF) vulnerability in multiple products
Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows CSRF in the VMware Harbor Container Registry for the Pivotal Platform.
6.8
2020-03-20 CVE-2019-19023 Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 has a Privilege Escalation Vulnerability in the VMware Harbor Container Registry for the Pivotal Platform.
network
low complexity
linuxfoundation pivotal
6.5
2020-03-03 CVE-2020-5403 Improper Handling of Exceptional Conditions vulnerability in Pivotal Reactor Netty 0.9.3/0.9.4
Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be closed prematurely instead of producing a 400 response.
network
low complexity
pivotal CWE-755
5.0
2020-03-03 CVE-2020-5404 Insufficiently Protected Credentials vulnerability in Pivotal Reactor Netty
The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain.
network
pivotal CWE-522
4.9
2020-01-27 CVE-2019-11288 Improper Privilege Management vulnerability in Pivotal TC Runtimes and TC Server
In Pivotal tc Server, 3.x versions prior to 3.2.19 and 4.x versions prior to 4.0.10, and Pivotal tc Runtimes, 7.x versions prior to 7.0.99.B, 8.x versions prior to 8.5.47.A, and 9.x versions prior to 9.0.27.A, when a tc Runtime instance is configured with the JMX Socket Listener, a local attacker without access to the tc Runtime process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface.
1.9
2019-10-17 CVE-2019-11284 Insufficiently Protected Credentials vulnerability in Pivotal Reactor Netty
Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones.
network
low complexity
pivotal CWE-522
5.0
2019-10-01 CVE-2019-11275 Improper Neutralization of Formula Elements in a CSV File vulnerability in multiple products
Pivotal Application Manager, versions 666.0.x prior to 666.0.36, versions 667.0.x prior to 667.0.22, versions 668.0.x prior to 668.0.21, versions 669.0.x prior to 669.0.13, and versions 670.0.x prior to 670.0.7, contain a vulnerability where a remote authenticated user can create an app with a name such that a csv program can interpret into a formula and gets executed.
network
low complexity
pivotal pivotal-software CWE-1236
4.0
2019-08-05 CVE-2019-3800 Information Exposure vulnerability in multiple products
CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag.
2.1