Product by Cloud Foundry
Cf Deployment
28 known vulnerabilities in Cf Deployment (Cloud Foundry), 0 of them actively exploited (CISA KEV).
Key figures
28
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2019-11277 | Volume Services is vulnerable to an LDAP injection attack | 8.4 | |
| High | CVE-2019-11289 | A forged route service request using an invalid nonce can cause the gorouter to panic and crash | 8.6 | |
| High | CVE-2019-11283 | Password leak in smbdriver logs | 8.8 | |
| High | CVE-2018-1265 | Cloud Foundry Diego: security vulnerability | 7.2 | |
| High | CVE-2019-11293 | UAA logs all query parameters with debug logging level | 8.8 | |
| High | CVE-2026-59335 | Cloud Foundry UAA: Improper Handling of Case Sensitivity | 8.7 | |
| High | CVE-2019-11290 | Cloud Foundry UAA logs query parameters in tomcat access file | 8.8 | |
| High | CVE-2026-59358 | Cloud Foundry UAA: Improper Authentication | — | |
| High | CVE-2020-5416 | CF clusters with NGINX in front of them may be vulnerable to DoS | 7.7 | |
| High | CVE-2018-1262 | CloudFoundry UAA: Privilege Escalation | 7.2 | |
| High | CVE-2020-5420 | Gorouter is vulnerable to DoS attack via invalid HTTP responses | 7.7 | |
| High | CVE-2020-5417 | Cloud Controller may allow developers to claim sensitive routes | 8.5 | |
| High | CVE-2020-5423 | Cloud Controller is vulnerable to denial of service via YAML parsing | 7.5 | |
| High | CVE-2018-1191 | Cloud Foundry Garden-runC: Insertion of Sensitive Information Into Debugging Code | 8.8 | |
| Medium | CVE-2018-1277 | Cloud Foundry Garden-runC: security vulnerability | 6.5 | |
| High | CVE-2020-5400 | Cloud Controller logs environment variables from app manifests | 8.0 | |
| Critical | CVE-2026-41005 | UAA accepts SAML Encrypted Assertions authentication bypass | 9.0 | |
| Medium | CVE-2026-59357 | Self-UAA OIDC Configuration allows JWT injection to establish unauthorized sessions | — | |
| Critical | CVE-2019-3801 | Java Projects using HTTP to fetch dependencies | 8.7 | |
| Medium | CVE-2018-1193 | Cloud Foundry Router: security vulnerability | 5.3 | |
| High | CVE-2023-34061 | Cloud Foundry Routing Release: security vulnerability | 7.5 | |
| High | CVE-2020-5402 | UAA fails to check the state parameter when authenticating with external IDPs | 8.8 | |
| Medium | CVE-2019-11282 | UAA is vulnerable to a Blind SCIM injection leading to information disclosure | 4.3 | |
| Medium | CVE-2019-11294 | CAPI leaks service broker URLs and GUIDs to space developers | 4.3 | |
| High | CVE-2024-22279 | GoRouter Denial of Service Attack | 5.9 |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 24sans-atrisk-mail,