Vulnerabilities > Pivotal > High

DATE CVE VULNERABILITY TITLE RISK
2024-01-12 CVE-2023-34061 Resource Exhaustion vulnerability in Pivotal Cloud Foundry Deployment
Cloud Foundry routing release versions from v0.163.0 to v0.283.0 are vulnerable to a DOS attack.
network
low complexity
pivotal CWE-400
7.5
2023-11-28 CVE-2023-34054 Unspecified vulnerability in Pivotal Reactor Netty
In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition. Specifically, an application is vulnerable if Reactor Netty HTTP Server built-in integration with Micrometer is enabled.
network
low complexity
pivotal
7.5
2023-11-15 CVE-2023-34062 Path Traversal vulnerability in Pivotal Reactor Netty
In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted URL that can lead to a directory traversal attack. Specifically, an application is vulnerable if Reactor Netty HTTP Server is configured to serve static resources.
network
low complexity
pivotal CWE-22
7.5
2020-03-20 CVE-2019-19029 SQL Injection vulnerability in multiple products
Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via user-groups in the VMware Harbor Container Registry for the Pivotal Platform.
network
low complexity
linuxfoundation pivotal CWE-89
7.2
2020-03-20 CVE-2019-19025 Cross-Site Request Forgery (CSRF) vulnerability in multiple products
Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows CSRF in the VMware Harbor Container Registry for the Pivotal Platform.
network
low complexity
linuxfoundation pivotal CWE-352
8.8
2020-03-20 CVE-2019-19023 Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 has a Privilege Escalation Vulnerability in the VMware Harbor Container Registry for the Pivotal Platform.
network
low complexity
linuxfoundation pivotal
8.8
2020-03-03 CVE-2020-5403 Improper Handling of Exceptional Conditions vulnerability in Pivotal Reactor Netty 0.9.3/0.9.4
Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be closed prematurely instead of producing a 400 response.
network
low complexity
pivotal CWE-755
7.5
2020-01-27 CVE-2019-11288 Unspecified vulnerability in Pivotal TC Runtimes and TC Server
In Pivotal tc Server, 3.x versions prior to 3.2.19 and 4.x versions prior to 4.0.10, and Pivotal tc Runtimes, 7.x versions prior to 7.0.99.B, 8.x versions prior to 8.5.47.A, and 9.x versions prior to 9.0.27.A, when a tc Runtime instance is configured with the JMX Socket Listener, a local attacker without access to the tc Runtime process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface.
local
high complexity
pivotal
7.0
2019-10-17 CVE-2019-11284 Insufficiently Protected Credentials vulnerability in Pivotal Reactor Netty
Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones.
network
low complexity
pivotal CWE-522
8.6
2019-08-05 CVE-2019-3800 Information Exposure vulnerability in multiple products
CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag.
7.8