Cloud Foundry Elastic Runtime
Approved changes feed: RSS · Atom
cpe:2.3:a:pivotal_software:cloud_foundry_elastic_runtime:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Pivotal Software (a7eef617-cad9-5400-bbf0-2e56b16d90a7) |
|---|---|
| Product | Cloud Foundry Elastic Runtime (0c19cb52-f984-577a-b242-6f3366452d83) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/cloudfoundry-attic/cf-release |
purl2cpe | 2026-06-01 10:11:00.491593 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2016-6658 |
vulnerable | 2026-06-08 05:08:03.193864 |
Details available
Applications in cf-release before 245 can be configured and pushed with a user-provided custom buildpack using a URL pointing to the buildpack. Although it is not recommended, a user can specify a credential in the URL (basic auth or OAuth) to access the buildpack through the CLI. For example, the user could include a GitHub username and password in the URL to access a private repo. Because the URL to access the buildpack is stored unencrypted, an operator with privileged access to the Cloud Controller database could view these credentials.
Published: 2018-03-29T22:00:00.000Z
Updated: 2024-08-06T01:36:29.571Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-5016 |
vulnerable | 2026-06-08 05:07:56.013018 |
Details available
Pivotal Cloud Foundry 239 and earlier, UAA (aka User Account and Authentication Server) 3.4.1 and earlier, UAA release 12.2 and earlier, PCF (aka Pivotal Cloud Foundry) Elastic Runtime 1.6.x before 1.6.35, and PCF Elastic Runtime 1.7.x before 1.7.13 does not validate if a certificate is expired.
Published: 2017-04-24T19:00:00.000Z
Updated: 2024-08-06T00:46:40.228Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-5006 |
vulnerable | 2026-06-08 05:07:55.926981 |
Details available
The Cloud Controller in Cloud Foundry before 239 logs user-provided service objects at creation, which allows attackers to obtain sensitive user credential information via unspecified vectors.
Published: 2017-05-02T14:00:00.000Z
Updated: 2024-08-06T00:46:40.215Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-3084 |
vulnerable | 2026-06-08 05:07:44.343342 |
Details available
The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA release v10 and earlier versions and Pivotal Elastic Runtime versions prior to 1.7.2 is vulnerable to a brute force attack due to multiple active codes at a given time. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.
Published: 2017-05-25T17:00:00.000Z
Updated: 2024-08-05T23:40:15.665Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-2165 |
vulnerable | 2026-06-08 05:07:33.469945 |
Details available
The Loggregator Traffic Controller endpoints in cf-release v231 and lower, Pivotal Elastic Runtime versions prior to 1.5.19 AND 1.6.x versions prior to 1.6.20 are not cleansing request URL paths when they are invalid and are returning them in the 404 response. This could allow malicious scripts to be written directly into the 404 response.
Published: 2017-05-25T17:00:00.000Z
Updated: 2024-08-05T23:17:50.673Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-0926 |
vulnerable | 2026-06-08 05:07:16.563518 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-0896 |
vulnerable | 2026-06-08 05:07:16.473647 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-0715 |
vulnerable | 2026-06-08 05:07:15.896389 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-5173 |
vulnerable | 2026-06-08 05:06:49.076543 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-5172 |
vulnerable | 2026-06-08 05:06:49.076205 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-5171 |
vulnerable | 2026-06-08 05:06:49.075850 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-5170 |
vulnerable | 2026-06-08 05:06:49.074871 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-3191 |
vulnerable | 2026-06-08 05:06:37.470037 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-3190 |
vulnerable | 2026-06-08 05:06:37.469680 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-3189 |
vulnerable | 2026-06-08 05:06:37.468680 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-1834 |
vulnerable | 2026-06-08 05:06:26.401019 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.