Vulnerabilities for Login-server (...) - CXSECURITY.COM

Vulnerabilities for 'Login-server'

2017-05-25

CVE-2016-3084

The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA release v10 and earlier versions and Pivotal Elastic Runtime versions prior to 1.7.2 is vulnerable to a brute force attack due to multiple active codes at a given time. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.

CVE-2016-0781

The UAA OAuth approval pages in Cloud Foundry v208 to v231, Login-server v1.6 to v1.14, UAA v2.0.0 to v2.7.4.1, UAA v3.0.0 to v3.2.0, UAA-Release v2 to v7 and Pivotal Elastic Runtime 1.6.x versions prior to 1.6.20 are vulnerable to an XSS attack by specifying malicious java script content in either the OAuth scopes (SCIM groups) or SCIM group descriptions.

>>> Vendor: Pivotal software 54 Products

Rabbitmq management

Spring framework

Cloud foundry elastic runtime

Cloud foundry ops manager

Cloud foundry uaa

Cloud foundry uaa bosh

Operations manager

Spring data jpa

Cloud foundry cf mysql

Gemfire for pivotal cloud foundry

Spring security

Cloud foundry elastic runtime cf release

Cloud foundry uaa release

Login-server

Cloud foundry cf release

Cloud foundry garden linux

Cloud foundry cf

Single sign-on for pivotal cloud foundry

Spring advanced message queuing protocol

Credhub-release

Spring data rest

Cloud foundry uaa-release

Spring batch admin

Spring data commons

Spring cloud sso connector

Spring security oauth

Windows stemcells

Spring integration zip

Pivotal application service

Cloud foundry cf-deployment

Cloudfoundry uaa release

Cloudfoundry uaa

Spring integration

Spring web services

Cloud foundry cf-release

Application service

Pivotal container service

Credhub service broker

Spring data java persistance api

Copyright 2024, cxsecurity.com