Operations Manager
Approved changes feed: RSS · Atom
cpe:2.3:a:pivotal_software:operations_manager:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Pivotal Software (a7eef617-cad9-5400-bbf0-2e56b16d90a7) |
|---|---|
| Product | Operations Manager (a352fc83-c02b-56c5-ad86-5859160b108c) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2019-3790 |
vulnerable | 2026-06-08 05:13:56.000218 |
Ops Manager uaa client issues tokens after refresh token expiration
MEDIUM (6.1)
The Pivotal Ops Manager, 2.2.x versions prior to 2.2.23, 2.3.x versions prior to 2.3.16, 2.4.x versions prior to 2.4.11, and 2.5.x versions prior to 2.5.3, contain configuration that circumvents refresh token expiration. A remote authenticated user can gain access to a browser session that was supposed to have expired, and access Ops Manager resources.
Published: 2019-06-06T19:16:16.854Z
Updated: 2024-09-16T22:20:48.221Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-3776 |
vulnerable | 2026-06-08 05:13:55.974229 |
Reflected XSS in Pivotal Operations Manager
HIGH (7.2)
Pivotal Operations Manager, 2.1.x versions prior to 2.1.20, 2.2.x versions prior to 2.2.16, 2.3.x versions prior to 2.3.10, 2.4.x versions prior to 2.4.3, contains a reflected cross site scripting vulnerability. A remote user that is able to convince an Operations Manager user to interact with malicious content could execute arbitrary JavaScript in the user's browser.
Published: 2019-03-07T19:00:00.000Z
Updated: 2024-09-17T00:11:48.970Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-11292 |
vulnerable | 2026-06-08 05:12:36.829077 |
Pivotal Ops Manager logs query parameters in tomcat access file
HIGH (8.8)
Pivotal Ops Manager, versions 2.4.x prior to 2.4.27, 2.5.x prior to 2.5.24, 2.6.x prior to 2.6.16, and 2.7.x prior to 2.7.5, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials, then they will be logged as well.
Published: 2020-01-08T23:55:12.316Z
Updated: 2024-09-16T18:54:10.028Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-11270 |
vulnerable | 2026-06-08 05:12:36.780112 |
UAA clients.write vulnerability
HIGH (7.3)
Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or scope can bypass the restrictions imposed on clients created via 'clients.write' and create clients with arbitrary scopes that the creator does not possess.
Published: 2019-08-05T16:21:54.798Z
Updated: 2024-09-17T04:19:01.006Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-15762 |
vulnerable | 2026-06-08 05:11:03.552393 |
Pivotal Operations Manager gives all users heightened privileges
CRITICAL (9)
Pivotal Operations Manager, versions 2.0.x prior to 2.0.24, versions 2.1.x prior to 2.1.15, versions 2.2.x prior to 2.2.7, and versions 2.3.x prior to 2.3.1, grants all users a scope which allows for privilege escalation. A remote malicious user who has been authenticated may create a new client with administrator privileges for Opsman.
Published: 2018-11-02T22:00:00.000Z
Updated: 2024-09-16T18:54:15.856Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-11081 |
vulnerable | 2026-06-08 05:10:37.855034 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-11046 |
vulnerable | 2026-06-08 05:10:37.719748 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-11045 |
vulnerable | 2026-06-08 05:10:37.718476 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-0897 |
vulnerable | 2026-06-08 05:07:16.482914 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-0883 |
vulnerable | 2026-06-08 05:07:16.449811 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.