Cloud Foundry Uaa Release (Oss)
10 CVEs affecting Cloud Foundry Uaa Release (Oss). Latest disclosed: 2019-09-26. Critical: 1, High: 6.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-3801 | Critical | 9.8 | 2019-04-25 | Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an insecure protocol to fetch dependencies when building. A remote… |
CVE-2019-11279 | High | 8.8 | 2019-09-26 | CF UAA versions prior to 74.1.0 can request scopes for a client that shouldn't be allowed by submitting an array of requested scopes. A remote malicious user c… |
CVE-2019-11278 | High | 8.8 | 2019-09-26 | CF UAA versions prior to 74.1.0, allow external input to be directly queried against. A remote malicious user with 'client.write' and 'groups.update' can craft… |
CVE-2019-3788 | High | 8.7 | 2019-04-25 | Cloud Foundry UAA Release, versions prior to 71.0, allows clients to be configured with an insecure redirect uri. Given a UAA client was configured with a wild… |
CVE-2019-3787 | High | 8.3 | 2019-06-19 | Cloud Foundry UAA, versions prior to 73.0.0, falls back to appending “unknown.org” to a user's email address when one is not provided and the user name does no… |
CVE-2019-11270 | High | 7.5 | 2019-08-05 | Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or scope can bypass the r… |
CVE-2019-3775 | High | 7.1 | 2019-03-07 | Cloud Foundry UAA, versions prior to v70.0, allows a user to update their own email address. A remote authenticated user can impersonate a different user by ch… |
CVE-2019-11274 | Medium | 6.1 | 2019-08-09 | Cloud Foundry UAA, versions prior to 74.0.0, is vulnerable to an XSS attack. A remote unauthenticated malicious attacker could craft a URL that contains a SCIM… |
CVE-2019-3794 | Medium | 5.4 | 2019-07-18 | Cloud Foundry UAA, versions prior to v73.4.0, does not set an X-FRAME-OPTIONS header on various endpoints. A remote user can perform clickjacking attacks on UA… |
CVE-2019-11268 | Medium | 4.3 | 2019-07-11 | Cloud Foundry UAA version prior to 73.3.0, contain endpoints that contains improper escaping. An authenticated malicious user with basic read privileges for on… |