Skip to content
OpenAdvisories

Vendor

Pivotal

67 known vulnerabilities.

Products

Cloud Foundry 10 Spring Framework 7 Concourse 4 Pivotal Application Service 4 Pivotal Ops Manager 4 RabbitMQ 3 Reactor Netty 3 Apps Manager 3 Spring Security OAuth 3 Spring Security 3 Pivotal Application Service (PAS) 2 RabbitMQ for PCF 2 RabbitMQ for Pivotal Platform 2 Pivotal Operations Manager 2 Application Service 2 Spring Integration Zip 2 Greenplum Command Center 1 Spring Cloud SSO Connector 1 Gemfire for PCF 1 Spring Data Commons 1 Pivotal Container Service 1 On Demand Services SDK 1 Pivotal tc Server 4.x 1 Pivotal tc Server 3.x 1 Pivotal tc Server 4.x Runtimes 1 Pivotal tc Server 3.x Runtimes 1 Pivotal Container Service (PKS) 1 UAA Release (LTS) 1 Operations Manager 1 Spring AMQP 1 Spring MVC 1 Cloud Cache 1 Pivotal Spring Data REST and Spring Boot 1 VMware Tanzu Application Service for VMs 1 Pivotal Cloud Foundry Elastic Runtime 1
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 4.5
    CVE-2019-11287 Public exploit

    RabbitMQ Web Management Plugin DoS via heap overflow

    Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack…

    Pivotal RabbitMQ RabbitMQ for Pivotal Platform rabbitmq-server Debian Ubuntu Hex
  • Medium 4.7
    CVE-2018-1263 Public exploit

    spring-integration-zip Arbitrary File Write

    Addresses partial fix in CVE-2018-1261. Pivotal spring-integration-zip, versions prior to 1.0.2, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar, xz, war, cp…

    Pivotal Spring Integration Zip org.springframework.integration:spring-integration-zip Maven
  • High 7.5
    CVE-2018-1259 Public exploit

    Spring Data Commons, used in combination with XMLBeam, contains a property binder vulnerability caused by improper restriction of XML external entity references

    Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper restriction of XML external entity references as underlying li…

    Pivotal Spring Data Commons org.springframework.data:spring-data-commons Maven
  • Critical 9.8
    CVE-2018-1260 Public exploit EPSS 11%

    Spring Security OAuth vulnerable to remote code execution (RCE)

    Spring Security OAuth, versions 2.3 prior to 2.3.3, 2.2 prior to 2.2.2, 2.1 prior to 2.1.2, 2.0 prior to 2.0.15 and older unsupported versions contains a remote code execution vulnerability. A malicious user or attacker can craft an authorization request to t…

    Pivotal Spring Security OAuth org.springframework.security.oauth:spring-security-oauth2 Maven
  • Critical 9.8
    CVE-2017-8046 Public exploit Scanner template EPSS 75%

    Remote code execution in PATCH requests in Spring Data REST

    Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.

    Pivotal Pivotal Spring Data REST and Spring Boot org.springframework.data:spring-data-rest-core Maven
  • High 8.8
    CVE-2016-4977 Public exploit Scanner template EPSS 80%

    Spring Security OAuth vulnerable to remote code execution (RCE) via specially crafted request using whitelabel views

    When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the response_type parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the…

    Pivotal Spring Security OAuth org.springframework.security.oauth:spring-security-oauth2 Maven