Pivotal vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2021-22112 Spring Security 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, 5.2.x prior to 5.2.9.RELEASE, and older unsupported versions can fail to save the SecurityCoHigh 8.8 · Feb 23, 2021
• CVE-2020-5403 Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be closed prematurely instead of producing High 7.5 · Mar 3, 2020
• CVE-2019-11288 In Pivotal tc Server, 3.x versions prior to 3.2.19 and 4.x versions prior to 4.0.10, and Pivotal tc Runtimes, 7.x versions prior to 7.0.99.B, 8.x versions priorHigh 7 · Jan 27, 2020
• CVE-2019-11287 Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versionHigh 7.5 · Nov 22, 2019
• CVE-2019-11284 Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones.High 8.6 · Oct 17, 2019
• CVE-2019-11280 Pivotal Apps Manager, included in Pivotal Application Service versions 2.3.x prior to 2.3.18, 2.4.x prior to 2.4.14, 2.5.x prior to 2.5.10, and 2.6.x prior to 2High 8.8 · Sep 20, 2019
• CVE-2019-3793 Pivotal Apps Manager Release, versions 665.0.x prior to 665.0.28, versions 666.0.x prior to 666.0.21, versions 667.0.x prior to 667.0.7, contain an invitation sCritical 9.8 · Apr 24, 2019
• CVE-2019-3777 Pivotal Application Service (PAS), versions 2.2.x prior to 2.2.12, 2.3.x prior to 2.3.7 and 2.4.x prior to 2.4.3, contain apps manager that uses a cloud controlHigh 8 · Mar 7, 2019
• CVE-2019-3776 Pivotal Operations Manager, 2.1.x versions prior to 2.1.20, 2.2.x versions prior to 2.2.16, 2.3.x versions prior to 2.3.10, 2.4.x versions prior to 2.4.3, contaHigh 7.2 · Mar 7, 2019
• CVE-2018-15798 Pivotal Concourse Release, versions 4.x prior to 4.2.2, login flow allows redirects to untrusted websites.High 7.6 · Dec 19, 2018
• CVE-2018-1279 Pivotal RabbitMQ for PCF, all versions, uses a deterministically generated cookie that is shared between all machines when configured in a multi-tenant cluster.High 8.5 · Dec 10, 2018
• CVE-2018-15759 Pivotal Cloud Foundry On Demand Services SDK, versions prior to 0.24 contain an insecure method of verifying credentials.Critical 9.1 · Nov 19, 2018
• CVE-2018-15758 Spring Security OAuth, versions 2.3 prior to 2.3.4, and 2.2 prior to 2.2.3, and 2.1 prior to 2.1.3, and 2.0 prior to 2.0.16, and older unsupported versions coulCritical 9.6 · Oct 18, 2018
• CVE-2018-15756 Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide supporHigh 7.5 · Oct 18, 2018
• CVE-2018-15763 Pivotal Container Service, versions prior to 1.2.0, contains an information disclosure vulnerability which exposes IaaS credentials to application logs.Critical 9 · Oct 5, 2018
• CVE-2018-11081 Pivotal Operations Manager, versions 2.2.x prior to 2.2.1, 2.1.x prior to 2.1.11, 2.0.x prior to 2.0.16, and 1.11.x prior to 2, fails to write the Operations MaHigh 7.9 · Oct 5, 2018
• CVE-2018-1198 Pivotal Cloud Cache, versions prior to 1.3.1, prints a superuser password in plain text during BOSH deployment logs.High 8.8 · Sep 17, 2018
• CVE-2018-11088 Pivotal Applications Manager in Pivotal Application Service, versions 2.0 prior to 2.0.21 and 2.1 prior to 2.1.13 and 2.2 prior to 2.2.5, contains a bug which mHigh 8.8 · Sep 17, 2018
• CVE-2018-11086 Pivotal Usage Service in Pivotal Application Service, versions 2.0 prior to 2.0.21 and 2.1 prior to 2.1.13 and 2.2 prior to 2.2.5, contains a bug which may alloHigh 8.8 · Sep 17, 2018
• CVE-2018-11049 RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance, and RSA IMG releases have an uncontrolled search vulnerability.High 7.3 · Jul 11, 2018
• CVE-2018-11040 Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requestHigh 7.5 · Jun 25, 2018
• CVE-2018-1280 Pivotal Greenplum Command Center versions 2.x prior to 2.5.1 contains a blind SQL injection vulnerability.High 7.5 · May 11, 2018
• CVE-2018-1260 Spring Security OAuth, versions 2.3 prior to 2.3.3, 2.2 prior to 2.2.2, 2.1 prior to 2.1.2, 2.0 prior to 2.0.15 and older unsupported versions contains a remoteCritical 9.8 · May 11, 2018
• CVE-2018-1259 Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binHigh 7.5 · May 11, 2018
• CVE-2018-1258 Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security.High 8.8 · May 11, 2018