Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2019-11263 State: REJECTED Published: 2020-02-03T15:00:27 Last Updated: 2020-02-03T15:00:27 Description: No description available.
CVE ID: CVE-2019-11264 State: REJECTED Published: 2020-02-03T15:00:28 Last Updated: 2020-02-03T15:00:28 Description: No description available.
CVE ID: CVE-2019-11265 State: REJECTED Published: 2020-02-03T15:00:28 Last Updated: 2020-02-03T15:00:28 Description: No description available.
CVE ID: CVE-2019-11266 State: REJECTED Published: 2020-02-03T15:00:28 Last Updated: 2020-02-03T15:00:28 Description: No description available.
CVE ID: CVE-2019-11267 State: REJECTED Published: 2020-02-03T15:00:29 Last Updated: 2020-02-03T15:00:29 Description: No description available.
CVE ID: CVE-2019-11268 State: PUBLISHED Published: 2019-07-11T18:11:36.916271Z Last Updated: 2024-09-17T03:13:54.242Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Cloud Foundry Products: UAA Release (OSS) Problem Types: CWE-200 Description: Cloud Foundry UAA version prior to 73.3.0, contain endpoints that contains improper escaping. An authenticated malicious user with basic read privileges for one identity zone can extend those reading privileges to all other identity zones and obtain private information on users, clients, and groups in all other identity zones. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org
all other identity zones. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2019-11268
CVE ID: CVE-2019-11269 State: PUBLISHED Published: 2019-06-12T14:46:18.601170Z Last Updated: 2024-09-16T23:11:41.537Z Severity: MEDIUM (CVSS 4.2 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: Spring Products: Spring Security OAuth Problem Types: CWE-601 Description: Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the redirect_uri p
ation endpoint using the authorization code grant type, and specify a manipulated redirection URI via the redirect_uri parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code. Additional Analyst Notes: - CVE Program Container: References: - https://www.oracle.com/security-alerts/cpujan2021.html - https://pivotal.io/security/cve-2019-11269 - http://packetstormsecurity.com/files/153299/Spring-Security-OAuth-2.3-Open-Redirection.html
CVE ID: CVE-2019-11270 State: PUBLISHED Published: 2019-08-05T16:21:54.798114Z Last Updated: 2024-09-17T04:19:01.006Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N) Vendors: Cloud Foundry Products: UAA Release (OSS) Problem Types: CWE-269 Description: Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or scope can bypass the restrictions imposed on clients created via 'clients.write' and create clients with arbitrary scopes that the creator does not possess. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2019-11270 - https://pivota
Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2019-11270 - https://pivotal.io/security/cve-2019-11270
CVE ID: CVE-2019-11271 State: PUBLISHED Published: 2019-06-18T23:38:15.403356Z Last Updated: 2024-09-17T00:37:19.176Z Severity: MEDIUM (CVSS 6 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Cloud Foundry Products: BOSH Problem Types: CWE-532 Description: Cloud Foundry BOSH 270.x versions prior to v270.1.1, contain a BOSH Director that does not properly redact credentials when configured to use a MySQL database. A local authenticated malicious user may read any credentials that are contained in a BOSH manifest. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2019-11271
CVE ID: CVE-2019-11272 State: PUBLISHED Published: 2019-06-26T14:06:15.312137Z Last Updated: 2024-09-16T19:25:59.208Z Vendors: Spring Products: Spring Security Problem Types: CWE-287 Description: Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of "null". Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2019-11272 - https://lists.debian.org/debian-lts-an
CVE Program Container: References: - https://pivotal.io/security/cve-2019-11272 - https://lists.debian.org/debian-lts-announce/2019/07/msg00008.html
CVE ID: CVE-2019-11273 State: PUBLISHED Published: 2019-07-23T22:34:08.022548Z Last Updated: 2024-09-16T18:04:10.968Z Severity: LOW (CVSS 2.2 CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: Pivotal Products: Pivotal Container Service (PKS) Problem Types: CWE-532 Description: Pivotal Container Services (PKS) versions 1.3.x prior to 1.3.7, and versions 1.4.x prior to 1.4.1, contains a vulnerable component which logs the username and password to the billing database. A remote authenticated user with access to those logs may be able to retrieve non-sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/CVE-2019-11273
CVE ID: CVE-2019-11274 State: PUBLISHED Published: 2019-08-09T19:22:17.731034Z Last Updated: 2024-09-16T20:12:34.197Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Cloud Foundry Products: UAA Release (OSS) Problem Types: CWE-79 Description: Cloud Foundry UAA, versions prior to 74.0.0, is vulnerable to an XSS attack. A remote unauthenticated malicious attacker could craft a URL that contains a SCIM filter that contains malicious JavaScript, which older browsers may execute. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2019-11274
CVE ID: CVE-2019-11275 State: PUBLISHED Published: 2019-10-01T14:17:40.183578Z Last Updated: 2024-09-17T02:57:24.557Z Severity: LOW (CVSS 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: Pivotal Products: Apps Manager Problem Types: CWE-74 Description: Pivotal Application Manager, versions 666.0.x prior to 666.0.36, versions 667.0.x prior to 667.0.22, versions 668.0.x prior to 668.0.21, versions 669.0.x prior to 669.0.13, and versions 670.0.x prior to 670.0.7, contain a vulnerability where a remote authenticated user can create an app with a name such that a csv program can interpret into a formula and gets executed. The malicious user can possibly gain access to a usage report tha
rogram can interpret into a formula and gets executed. The malicious user can possibly gain access to a usage report that requires a higher privilege. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2019-11275
CVE ID: CVE-2019-11276 State: PUBLISHED Published: 2019-08-19T14:49:27.910651Z Last Updated: 2024-09-16T16:13:54.745Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: Pivotal Products: Pivotal Application Service (PAS) Problem Types: CWE-319 Description: Pivotal Apps Manager, included in Pivotal Application Service versions 2.3.x prior to 2.3.16, 2.4.x prior to 2.4.12, 2.5.x prior to 2.5.8, and 2.6.x prior to 2.6.3, makes a request to the /cloudapplication endpoint via Spring actuator, and subsequent requests via unsecured http. An adjacent unauthenticated user could eavesdrop on the network traffic and gain access to the unencrypted token allowing the attack
unauthenticated user could eavesdrop on the network traffic and gain access to the unencrypted token allowing the attacker to read the type of access a user has over an app. They may also modify the logging level, potentially leading to lost information that would otherwise have been logged. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2019-11276
CVE ID: CVE-2019-11277 State: PUBLISHED Published: 2019-09-23T17:40:18.215999Z Last Updated: 2024-09-16T20:47:05.168Z Severity: HIGH (CVSS 8.4 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L) Vendors: Cloud Foundry Products: CF NFS volume release, CF Deployment Problem Types: CWE-90 Description: Cloud Foundry NFS Volume Service, 1.7.x versions prior to 1.7.11 and 2.x versions prior to 2.3.0, is vulnerable to LDAP injection. A remote authenticated malicious space developer can potentially inject LDAP filters via service instance creation, facilitating the malicious space developer to deny service or perform a dictionary attack. Additional Analyst Notes: - CVE Program Container: References: - htt
per to deny service or perform a dictionary attack. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2019-11277
CVE ID: CVE-2019-11278 State: PUBLISHED Published: 2019-09-26T21:11:24.033285Z Last Updated: 2024-09-16T23:51:53.473Z Severity: HIGH (CVSS 8.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: Cloud Foundry Products: UAA Release (OSS) Problem Types: CWE-77 Description: CF UAA versions prior to 74.1.0, allow external input to be directly queried against. A remote malicious user with 'client.write' and 'groups.update' can craft a SCIM query, which leaks information that allows an escalation of privileges, ultimately allowing the malicious user to gain control of UAA scopes they should not have. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/b
es they should not have. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2019-11278
CVE ID: CVE-2019-11279 State: PUBLISHED Published: 2019-09-26T21:15:10.245483Z Last Updated: 2024-09-17T02:36:57.958Z Severity: HIGH (CVSS 8.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: Cloud Foundry Products: UAA Release (OSS) Problem Types: CWE-77 Description: CF UAA versions prior to 74.1.0 can request scopes for a client that shouldn't be allowed by submitting an array of requested scopes. A remote malicious user can escalate their own privileges to any scope, allowing them to take control of UAA and the resources it controls. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2019-11279
CVE ID: CVE-2019-11280 State: PUBLISHED Published: 2019-09-20T18:35:17.756215Z Last Updated: 2024-09-16T19:20:44.714Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Pivotal Products: Pivotal Application Service (PAS) Problem Types: CWE-269 Description: Pivotal Apps Manager, included in Pivotal Application Service versions 2.3.x prior to 2.3.18, 2.4.x prior to 2.4.14, 2.5.x prior to 2.5.10, and 2.6.x prior to 2.6.5, contains an invitations microservice which allows users to invite others to their organizations. A remote authenticated user can gain additional privileges by inviting themselves to spaces that they should not have access to. Additional Analyst Not
gain additional privileges by inviting themselves to spaces that they should not have access to. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2019-11280
CVE ID: CVE-2019-11281 State: PUBLISHED Published: 2019-10-16T15:23:47.309415Z Last Updated: 2024-09-16T19:05:38.917Z Severity: LOW (CVSS 2.4 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N) Vendors: Pivotal Products: RabbitMQ, RabbitMQ for PCF Problem Types: CWE-79 Description: Pivotal RabbitMQ, versions prior to v3.7.18, and RabbitMQ for PCF, versions 1.15.x prior to 1.15.13, versions 1.16.x prior to 1.16.6, and versions 1.17.x prior to 1.17.3, contain two components, the virtual host limits page, and the federation management UI, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack that would gai
remote authenticated malicious user with administrative access could craft a cross site scripting attack that would gain access to virtual hosts and policy management information. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2019-11281 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EEQ6O7PMNJKYFMQYHAB55L423GYK63SO/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PYTGR3D5FW2O25RXZOTIZMOD2HAUVBE4/ - https://access.redhat.com/errata/RHSA-2020:0078 - https://lists.debian.org/debian-lts-announce/2021/07/msg00011.html
CVE ID: CVE-2019-11282 State: PUBLISHED Published: 2019-10-23T15:28:24.395096Z Last Updated: 2024-09-16T23:26:37.789Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Cloud Foundry Products: UAA Release, CF Deployment Problem Types: CWE-200 Description: Cloud Foundry UAA, versions prior to v74.3.0, contains an endpoint that is vulnerable to SCIM injection attack. A remote authenticated malicious user with scim.invite scope can craft a request with malicious content which can leak information about users of the UAA. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2019-11282
CVE ID: CVE-2019-11283 State: PUBLISHED Published: 2019-10-23T15:32:22.206840Z Last Updated: 2024-09-17T02:01:09.354Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Cloud Foundry Products: SMB Volume, CF Deployment Problem Types: CWE-532 Description: Cloud Foundry SMB Volume, versions prior to v2.0.3, accidentally outputs sensitive information to the logs. A remote user with access to the SMB Volume logs can discover the username and password for volumes that have been recently created, allowing the user to take control of the SMB Volume. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2019-11283
CVE ID: CVE-2019-11284 State: PUBLISHED Published: 2019-10-17T17:40:12.123879Z Last Updated: 2024-09-16T23:36:09.978Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Pivotal Products: Reactor Netty Problem Types: CWE-522 Description: Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2019-11284
CVE ID: CVE-2019-11285 State: REJECTED Published: 2020-04-16T21:50:10 Last Updated: 2020-04-16T21:50:10 Description: No description available.
CVE ID: CVE-2019-11286 State: PUBLISHED Published: 2020-07-31T19:40:19.094851Z Last Updated: 2024-09-16T23:46:18.238Z Severity: CRITICAL (CVSS 9 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H) Vendors: VMware Tanzu Products: VMware GemFire, VMware Tanzu GemFire for VMs Problem Types: CWE-502 Description: VMware GemFire versions prior to 9.10.0, 9.9.1, 9.8.5, and 9.7.5, and VMware Tanzu GemFire for VMs versions prior to 1.11.0, 1.10.1, 1.9.2, and 1.8.2, contain a JMX service available to the network which does not properly restrict input. A remote authenticated malicious user may request against the service with a crafted set of credentials leading to remote code execution. Additional Analyst N
may request against the service with a crafted set of credentials leading to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://tanzu.vmware.com/security/cve-2019-11286
CVE ID: CVE-2019-11287 State: PUBLISHED Published: 2019-11-22T23:26:08.880149Z Last Updated: 2024-09-16T22:24:51.121Z Severity: MEDIUM (CVSS 4.5 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H) Vendors: Pivotal Products: RabbitMQ for Pivotal Platform, RabbitMQ Problem Types: CWE-400 Description: Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack. The "X-Reason" HTTP Header can be leveraged to insert a malicious Erlang format string that will expand and consume the heap, resulting in the se
r can be leveraged to insert a malicious Erlang format string that will expand and consume the heap, resulting in the server crashing. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2019-11287 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EEQ6O7PMNJKYFMQYHAB55L423GYK63SO/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PYTGR3D5FW2O25RXZOTIZMOD2HAUVBE4/ - https://access.redhat.com/errata/RHSA-2020:0078 - https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2019-11287-DoS%20via%20Heap%20Overflow-RabbitMQ%20Web%20Management%20Plugin -
DrunkenShells/Disclosures/tree/master/CVE-2019-11287-DoS%20via%20Heap%20Overflow-RabbitMQ%20Web%20Management%20Plugin - https://lists.debian.org/debian-lts-announce/2021/07/msg00011.html
CVE ID: CVE-2019-11288 State: PUBLISHED Published: 2020-01-27T18:50:13.211744Z Last Updated: 2024-09-17T04:09:48.305Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Pivotal Products: Pivotal tc Server 4.x, Pivotal tc Server 3.x, Pivotal tc Server 4.x Runtimes, Pivotal tc Server 3.x Runtimes Problem Types: CWE-269 Description: In Pivotal tc Server, 3.x versions prior to 3.2.19 and 4.x versions prior to 4.0.10, and Pivotal tc Runtimes, 7.x versions prior to 7.0.99.B, 8.x versions prior to 8.5.47.A, and 9.x versions prior to 9.0.27.A, when a tc Runtime instance is configured with the JMX Socket Listener, a local attacker without access to the tc Runtime process
Runtime instance is configured with the JMX Socket Listener, a local attacker without access to the tc Runtime process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the tc Runtime instance. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2019-11288
CVE ID: CVE-2019-11289 State: PUBLISHED Published: 2019-11-19T18:41:04.566878Z Last Updated: 2024-09-16T22:14:00.610Z Severity: HIGH (CVSS 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Cloud Foundry Products: Routing Problem Types: CWE-20 Description: Cloud Foundry Routing, all versions before 0.193.0, does not properly validate nonce input. A remote unauthenticated malicious user could forge an HTTP route service request using an invalid nonce that will cause the Gorouter to crash. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2019-11289
CVE ID: CVE-2019-11290 State: PUBLISHED Published: 2019-11-25T23:56:17.082402Z Last Updated: 2024-09-16T21:02:44.357Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Cloud Foundry Products: UAA Release Problem Types: CWE-532 Description: Cloud Foundry UAA Release, versions prior to v74.8.0, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials, then they will be logged as well. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2019-11290
CVE ID: CVE-2019-11291 State: PUBLISHED Published: 2019-11-22T22:56:08.641103Z Last Updated: 2024-09-17T00:31:38.392Z Severity: LOW (CVSS 3.1 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N) Vendors: Pivotal Products: RabbitMQ, RabbitMQ for Pivotal Platform Problem Types: CWE-79 Description: Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain two endpoints, federation and shovel, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack via the vhost or node name fields that cou
ous user with administrative access could craft a cross site scripting attack via the vhost or node name fields that could grant access to virtual hosts and policy management information. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2019-11291 - https://access.redhat.com/errata/RHSA-2020:0553
CVE ID: CVE-2019-11292 State: PUBLISHED Published: 2020-01-08T23:55:12.316314Z Last Updated: 2024-09-16T18:54:10.028Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Pivotal Products: Pivotal Ops Manager Problem Types: CWE-532 Description: Pivotal Ops Manager, versions 2.4.x prior to 2.4.27, 2.5.x prior to 2.5.24, 2.6.x prior to 2.6.16, and 2.7.x prior to 2.7.5, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials, then they will be logged as well. Additional Analyst Notes: - CVE Program Container: References: - https://pivotal.io/security/cve-2019-11292
CVE ID: CVE-2019-11293 State: PUBLISHED Published: 2019-12-06T20:00:17.131916Z Last Updated: 2024-09-16T17:57:54.838Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Cloud Foundry Products: UAA Release Problem Types: CWE-532 Description: Cloud Foundry UAA Release, versions prior to v74.10.0, when set to logging level DEBUG, logs client_secret credentials when sent as a query parameter. A remote authenticated malicious user could gain access to user credentials via the uaa.log file if authentication is provided via query parameters. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2019-11293
CVE ID: CVE-2019-11294 State: PUBLISHED Published: 2019-12-19T19:35:11.666435Z Last Updated: 2024-09-17T02:27:12.722Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Cloud Foundry Products: CAPI Problem Types: CWE-200 Description: Cloud Foundry Cloud Controller API (CAPI), version 1.88.0, allows space developers to list all global service brokers, including service broker URLs and GUIDs, which should only be accessible to admins. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudfoundry.org/blog/cve-2019-11294
CVE ID: CVE-2019-11295 State: REJECTED Published: 2021-01-25T17:19:32 Last Updated: 2021-01-25T17:19:32 Description: No description available.
CVE ID: CVE-2019-11296 State: REJECTED Published: 2021-01-25T17:19:32 Last Updated: 2021-01-25T17:19:32 Description: No description available.
CVE ID: CVE-2019-11297 State: REJECTED Published: 2021-01-25T17:19:32 Last Updated: 2021-01-25T17:19:32 Description: No description available.
CVE ID: CVE-2019-11298 State: REJECTED Published: 2021-01-25T17:19:32 Last Updated: 2021-01-25T17:19:32 Description: No description available.
CVE ID: CVE-2019-11299 State: REJECTED Published: 2021-01-25T17:19:32 Last Updated: 2021-01-25T17:19:32 Description: No description available.
CVE ID: CVE-2019-11300 State: REJECTED Published: 2021-01-25T17:19:32 Last Updated: 2021-01-25T17:19:32 Description: No description available.
CVE ID: CVE-2019-11301 State: REJECTED Published: 2021-01-25T17:19:32 Last Updated: 2021-01-25T17:19:32 Description: No description available.
CVE ID: CVE-2019-11302 State: REJECTED Published: 2021-01-25T17:19:33 Last Updated: 2021-01-25T17:19:33 Description: No description available.