Browse CVEs

MEDIUM 5.8 CVE-2026-41009 When the director sends a long-running request (e.g. compile_package), the agent's reply JSON is consumed by AgentClient. inject_compile_log (line 33… Bosh 282.1.12+ Fix from $1,6002026-05-27 MEDIUM 5.0 CVE-2026-41704 AgentClient#handle_method (lines 264-303) processes every NATS reply. It calls inject_compile_log (line 273) on every response, which reads response[… Bosh 282.1.12+ Fix from $1,6002026-05-27 MEDIUM 6.5 CVE-2020-5422 BOSH System Metrics Server releases prior to 0.1.0 exposed the UAA password as a flag to a process running on the BOSH director. It exposed the passw… Bosh System Metrics Server 0.1.0+ Fix from $1,6002020-10-02 HIGH 7.8 CVE-2019-11271 Cloud Foundry BOSH 270.x versions prior to v270.1.1, contain a BOSH Director that does not properly redact credentials when configured to use a MySQL… Bosh 270.1.1+ Fix from $1,9502019-06-19 MEDIUM 6.8 CVE-2018-15800 Cloud Foundry Bits Service, versions prior to 2.18.0, includes an information disclosure vulnerability. A remote malicious user may execute a timing … Bits Service 2.18.0+ Fix from $1,6002018-12-10 HIGH 8.8 CVE-2018-15755 Cloud Foundry CF Networking Release, versions 2.11.0 prior to 2.16.0, contain an internal api endpoint vulnerable to SQL injection between Diego cell… Cf Networking 2.16.0+ Fix from $1,9502018-10-12 HIGH 8.1 CVE-2018-11083 Cloud Foundry BOSH, versions v264 prior to v264.14.0 and v265 prior to v265.7.0 and v266 prior to v266.8.0 and v267 prior to v267.2.0, allows refresh… Bosh 264.14.0 / 265.7.0+ Fix from $1,9502018-10-05 HIGH 8.8 CVE-2017-4961 An issue was discovered in Cloud Foundry Foundation BOSH Release 261.x versions prior to 261.3 and all 260.x versions. In certain cases an authentica… Bosh Mitigation only Fix from $1,9502017-06-13 HIGH 7.5 CVE-2016-3091 Cloud Foundry Diego 0.1468.0 through 0.1470.0 allows remote attackers to cause a denial of service. Diego No fix yet Fix from $1,9502017-06-08