en
Pivotal was an enterprise software and technical-services provider focused on modern application development, cloud-native platforms, and helping organizations change how they build software. VMware completed its acquisition of Pivotal in December 2019, and the former Pivotal portfolio became part of Tanzu.
Severity across 67 analyzed records
| CVE | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-47874Reactor Netty HTTP Server Denial of Service With Pipelined Requests | Exploitation statusNot known exploited | FixYes | Affected productReactor Netty | Published08/26/2026 | SeverityMedium |
CVE-2023-34061CVE-2023-34061 – Gorouter route pruning | Exploitation statusNot known exploited | FixYes | Affected productRouting Release | Published01/12/2024 | SeverityHigh |
CVE-2023-34054Reactor Netty HTTP Server Metrics DoS Vulnerability | Exploitation statusNot confirmed | FixYes | Affected productReactor Netty | Published11/28/2023 | SeverityMedium |
CVE-2023-34062CVE-2023-34062 | Exploitation statusNot known exploited | FixYes | Affected productReactor Netty | Published11/15/2023 | SeverityHigh |
CVE-2023-20885CF workflows leak credentials in system audit logs | Exploitation statusNot known exploited | FixNot confirmed | Affected productNotifications | Published06/16/2023 | SeverityMedium |
CVE-2022-31684CVE-2022-31684 | Exploitation statusNot known exploited | FixNot confirmed | Affected productReactor Netty | Published10/19/2022 | SeverityMedium |
CVE-2022-22969CVE-2022-22969 | Exploitation statusNot confirmed | FixNot confirmed | Affected productSpring Security OAuth | Published04/21/2022 | SeverityUnknown |
CVE-2020-5409Concourse Open Redirect in the /sky/login endpoint | Exploitation statusNot confirmed | FixYes | Affected productConcourse | Published05/13/2020 | SeverityHigh |
CVE-2020-5406PCF Autoscaling logs its database credentials | Exploitation statusNot confirmed | FixYes | Affected productVMware Tanzu Application Service for VMs | Published04/10/2020 | SeverityUnknown |
CVE-2019-19023CVE-2019-19023 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/20/2020 | SeverityUnknown |
CVE-2019-19029CVE-2019-19029 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/20/2020 | SeverityUnknown |
CVE-2019-19026CVE-2019-19026 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/20/2020 | SeverityUnknown |
CVE-2019-19025CVE-2019-19025 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/20/2020 | SeverityUnknown |
CVE-2020-5403DoS Via Malformed URL with Reactor Netty HTTP Server | Exploitation statusNot confirmed | FixNot confirmed | Affected productReactor Netty | Published03/03/2020 | SeverityMedium |
CVE-2020-5404Authentication Leak On Redirect With Reactor Netty HttpClient | Exploitation statusNot confirmed | FixYes | Affected productReactor Netty | Published03/03/2020 | SeverityMedium |
CVE-2019-11288tcServer JMX Socket Listener Registry Rebinding Local Privilege Escalation | Exploitation statusNot confirmed | FixYes | Affected productPivotal tc Server 4.x | Published01/27/2020 | SeverityHigh |
CVE-2013-6430CVE-2013-6430 | Exploitation statusNot confirmed | FixNot confirmed | Affected productSpring MVC | Published01/10/2020 | SeverityUnknown |
CVE-2019-11292Pivotal Ops Manager logs query parameters in tomcat access file | Exploitation statusNot confirmed | FixYes | Affected productPivotal Ops Manager | Published01/08/2020 | SeverityHigh |
CVE-2019-11287RabbitMQ Web Management Plugin DoS via heap overflow | Exploitation statusNot confirmed | FixYes | Affected productRabbitMQ for Pivotal Platform | Published11/22/2019 | SeverityMedium |
CVE-2019-11291RabbitMQ XSS attack via federation and shovel endpoints | Exploitation statusNot confirmed | FixYes | Affected productRabbitMQ | Published11/22/2019 | SeverityLow |
CVE-2019-11284Reactor Netty authentication leak in redirects | Exploitation statusNot confirmed | FixNot confirmed | Affected productReactor Netty | Published10/17/2019 | SeverityMedium |
CVE-2019-11281RabbitMQ XSS attack | Exploitation statusNot confirmed | FixNot confirmed | Affected productRabbitMQ | Published10/16/2019 | SeverityLow |
CVE-2019-11275CSV Injection in usage report downloaded from Pivotal Application Manager | Exploitation statusNot confirmed | FixYes | Affected productApps Manager | Published10/01/2019 | SeverityLow |
CVE-2019-11280Privilege escalation through the invitations service | Exploitation statusNot confirmed | FixNot confirmed | Affected productPivotal Application Service (PAS) | Published09/20/2019 | SeverityHigh |
CVE-2019-11276Apps Manager sends tokens to Spring apps via HTTP | Exploitation statusNot confirmed | FixYes | Affected productPivotal Application Service (PAS) | Published08/19/2019 | SeverityMedium |
CVE-2019-3800CF CLI writes the client id and secret to config file | Exploitation statusNot confirmed | FixNot confirmed | Affected productCF CLI Release | Published08/05/2019 | SeverityMedium |
CVE-2019-11273PKS Telemetry logs credentials | Exploitation statusNot confirmed | FixNot confirmed | Affected productPivotal Container Service (PKS) | Published07/23/2019 | SeverityLow |
CVE-2019-3790Ops Manager uaa client issues tokens after refresh token expiration | Exploitation statusNot confirmed | FixYes | Affected productPivotal Ops Manager | Published06/06/2019 | SeverityMedium |
CVE-2019-3801Java Projects using HTTP to fetch dependencies | Exploitation statusNot confirmed | FixYes | Affected productUAA Release (LTS) | Published04/25/2019 | SeverityHigh |
CVE-2019-3788UAA redirect-uri allows wildcard in the subdomain | Exploitation statusNot confirmed | FixYes | Affected productPivotal Application Service | Published04/25/2019 | SeverityHigh |
CVE-2019-3793Invitations Service supports HTTP connections | Exploitation statusNot confirmed | FixYes | Affected productApps Manager | Published04/24/2019 | SeverityHigh |
CVE-2019-3792Concourse 5.0.0 SQL Injection vulnerability | Exploitation statusNot confirmed | FixYes | Affected productConcourse | Published04/01/2019 | SeverityMedium |
CVE-2019-3776Reflected XSS in Pivotal Operations Manager | Exploitation statusNot confirmed | FixYes | Affected productPivotal Ops Manager | Published03/07/2019 | SeverityHigh |
CVE-2019-3777Apps Manager unverified SSL certs in Cloud Controller proxy | Exploitation statusNot confirmed | FixYes | Affected productApps Manager | Published03/07/2019 | SeverityHigh |
CVE-2019-3803Concourse includes token in CLI authentication callback | Exploitation statusNot confirmed | FixYes | Affected productConcourse | Published01/12/2019 | SeverityMedium |
CVE-2018-15798Pivotal Concourse allows malicious redirect urls on login | Exploitation statusNot confirmed | FixYes | Affected productConcourse | Published12/19/2018 | SeverityHigh |
CVE-2018-1279RabbitMQ cluster compromise due to deterministically generated cookie | Exploitation statusNot confirmed | FixYes | Affected productRabbitMq for PCF | Published12/10/2018 | SeverityHigh |
CVE-2018-15759On Demand Services SDK Timing Attack Vulnerability | Exploitation statusNot confirmed | FixYes | Affected productOn Demand Services SDK | Published11/19/2018 | SeverityCritical |
CVE-2018-15758Privilege Escalation in spring-security-oauth2 | Exploitation statusNot confirmed | FixNot confirmed | Affected productSpring Security OAuth | Published10/18/2018 | SeverityCritical |
CVE-2018-15756DoS Attack via Range Requests | Exploitation statusNot confirmed | FixNot confirmed | Affected productSpring Framework | Published10/18/2018 | SeverityHigh |
CVE-2018-15763PKS leaks IaaS Credentials to Application Logs | Exploitation statusNot confirmed | FixYes | Affected productPivotal Container Service | Published10/05/2018 | SeverityCritical |
CVE-2018-11081Pivotal Operations Manager UAA config - temp Ram Disk | Exploitation statusNot confirmed | FixYes | Affected productpivotal-ops-manager | Published10/05/2018 | SeverityHigh |
CVE-2018-11086CVE-2018-11086 | Exploitation statusNot confirmed | FixYes | Affected productApplication Service | Published09/17/2018 | SeverityUnknown |
CVE-2018-11088CVE-2018-11088 | Exploitation statusNot confirmed | FixYes | Affected productApplication Service | Published09/17/2018 | SeverityUnknown |
CVE-2018-1198CVE-2018-1198 | Exploitation statusNot confirmed | FixYes | Affected productCloud Cache | Published09/17/2018 | SeverityUnknown |
CVE-2018-1223CVE-2018-1223 | Exploitation statusNot confirmed | FixYes | Affected productContainer Runtime | Published09/17/2018 | SeverityUnknown |
CVE-2018-11087TLS validation error | Exploitation statusNot confirmed | FixYes | Affected productSpring AMQP | Published09/14/2018 | SeverityUnknown |
CVE-2016-0715CVE-2016-0715 | Exploitation statusNot confirmed | FixNot confirmed | Affected productPivotal Cloud Foundry Elastic Runtime | Published09/11/2018 | SeverityUnknown |
CVE-2018-11044CVE-2018-11044 | Exploitation statusNot confirmed | FixYes | Affected productPivotal Application Service | Published07/24/2018 | SeverityUnknown |
CVE-2018-11045CVE-2018-11045 | Exploitation statusNot confirmed | FixYes | Affected productPivotal Operations Manager | Published07/11/2018 | SeverityUnknown |
CVE-2018-11049RSA Identity Governance and Lifecycle Uncontrolled Search Path Vulnerability | Exploitation statusNot confirmed | FixNot confirmed | Affected productPivotal Operations Manager | Published07/11/2018 | SeverityUnknown |
CVE-2018-11039CVE-2018-11039 | Exploitation statusNot confirmed | FixYes | Affected productSpring Framework | Published06/25/2018 | SeverityUnknown |
CVE-2018-11046CVE-2018-11046 | Exploitation statusNot confirmed | FixYes | Affected productOperations Manager | Published06/25/2018 | SeverityUnknown |
CVE-2018-11040CVE-2018-11040 | Exploitation statusNot confirmed | FixYes | Affected productSpring Framework | Published06/25/2018 | SeverityUnknown |
CVE-2017-3203Pivotal/Spring Spring-flex's Action Message Format (AMF3) Java implementation is vulnerable to insecure deserialization | Exploitation statusNot confirmed | FixNot confirmed | Affected productSpring-flex | Published06/11/2018 | SeverityUnknown |
CVE-2018-1263CVE-2018-1263 | Exploitation statusNot confirmed | FixNot confirmed | Affected productSpring Integration Zip | Published05/15/2018 | SeverityUnknown |
CVE-2018-1280CVE-2018-1280 | Exploitation statusNot confirmed | FixNot confirmed | Affected productGreenplum Command Center | Published05/11/2018 | SeverityUnknown |
CVE-2018-1257CVE-2018-1257 | Exploitation statusNot confirmed | FixNot confirmed | Affected productSpring Framework | Published05/11/2018 | SeverityUnknown |
CVE-2018-1261CVE-2018-1261 | Exploitation statusNot confirmed | FixNot confirmed | Affected productSpring Integration Zip | Published05/11/2018 | SeverityUnknown |
CVE-2018-1278CVE-2018-1278 | Exploitation statusNot confirmed | FixNot confirmed | Affected productPivotal Application Service | Published05/11/2018 | SeverityUnknown |
CVE-2018-1259CVE-2018-1259 | Exploitation statusNot confirmed | FixNot confirmed | Affected productSpring Data Commons | Published05/11/2018 | SeverityUnknown |
CVE-2018-1258CVE-2018-1258 | Exploitation statusNot confirmed | FixNot confirmed | Affected productSpring Framework | Published05/11/2018 | SeverityUnknown |
CVE-2018-1260CVE-2018-1260 | Exploitation statusNot confirmed | FixNot confirmed | Affected productSpring Security OAuth | Published05/11/2018 | SeverityUnknown |
CVE-2018-1256CVE-2018-1256 | Exploitation statusNot confirmed | FixNot confirmed | Affected productSpring Cloud SSO Connector | Published05/07/2018 | SeverityUnknown |
CVE-2016-8220CVE-2016-8220 | Exploitation statusNot confirmed | FixNot confirmed | Affected productGemfire for PCF | Published04/18/2018 | SeverityUnknown |
CVE-2017-8046CVE-2017-8046 | Exploitation statusPublic exploit | FixNot confirmed | Affected productPivotal Spring Data REST and Spring Boot | Published01/04/2018 | SeverityUnknown |
CVE-2018-1190CVE-2018-1190 | Exploitation statusNot confirmed | FixNot confirmed | Affected productPivotal Cloud Foundry products: all versions prior to cf-release v270, UAA v3.x prior to v3.20.2, and UAA bosh v30.x versions prior to v30.8 and all other versions prior to v45.0 | Published01/04/2018 | SeverityUnknown |
CVE-2017-8039CVE-2017-8039 | Exploitation statusNot confirmed | FixNot confirmed | Affected productSpring Web Flow Spring Web Flow 2.4.0 to 2.4.5 and Older unsupported versions are also affected | Published11/27/2017 | SeverityUnknown |
CVE-2017-8048CVE-2017-8048 | Exploitation statusNot confirmed | FixYes | Affected productCloud Controller VM capi-release versions 1.33.0 and later, prior to 1.42.0, cf-release versions 268 and later, prior to 274 | Published10/03/2017 | SeverityUnknown |
CVE-2017-8047CVE-2017-8047 | Exploitation statusNot confirmed | FixYes | Affected productCloud Foundry router routing-release all versions prior to v0.163.0 and cf-release all versions prior to v274 | Published10/03/2017 | SeverityUnknown |
CVE-2016-0732CVE-2016-0732 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/07/2017 | SeverityUnknown |
CVE-2017-4971CVE-2017-4971 | Exploitation statusNot confirmed | FixNot confirmed | Affected productSpring Web Flow | Published06/13/2017 | SeverityUnknown |
CVE-2017-4975CVE-2017-4975 | Exploitation statusNot confirmed | FixNot confirmed | Affected productPCF Tile Generator | Published06/13/2017 | SeverityUnknown |
CVE-2015-3189CVE-2015-3189 | Exploitation statusNot confirmed | FixNot confirmed | Affected productCloud Foundry | Published05/25/2017 | SeverityUnknown |
CVE-2016-0761CVE-2016-0761 | Exploitation statusNot confirmed | FixNot confirmed | Affected productCloud Foundry | Published05/25/2017 | SeverityUnknown |
CVE-2016-4977CVE-2016-4977 | Exploitation statusNot confirmed | FixNot confirmed | Affected productSpring Security OAuth | Published05/25/2017 | SeverityUnknown |
CVE-2015-3191CVE-2015-3191 | Exploitation statusNot confirmed | FixNot confirmed | Affected productCloud Foundry | Published05/25/2017 | SeverityUnknown |
CVE-2016-2165CVE-2016-2165 | Exploitation statusNot confirmed | FixNot confirmed | Affected productCloud Foundry | Published05/25/2017 | SeverityUnknown |
CVE-2016-4435CVE-2016-4435 | Exploitation statusNot confirmed | FixNot confirmed | Affected productCloud Foundry | Published05/25/2017 | SeverityUnknown |
CVE-2016-3084CVE-2016-3084 | Exploitation statusNot confirmed | FixNot confirmed | Affected productCloud Foundry | Published05/25/2017 | SeverityUnknown |
CVE-2014-0225CVE-2014-0225 | Exploitation statusNot confirmed | FixNot confirmed | Affected productSpring Framework | Published05/25/2017 | SeverityUnknown |
CVE-2014-0097CVE-2014-0097 | Exploitation statusNot confirmed | FixNot confirmed | Affected productSpring Security | Published05/25/2017 | SeverityUnknown |
CVE-2014-3527CVE-2014-3527 | Exploitation statusNot confirmed | FixNot confirmed | Affected productSpring Security | Published05/25/2017 | SeverityUnknown |
CVE-2016-5007CVE-2016-5007 | Exploitation statusNot confirmed | FixNot confirmed | Affected productSpring Security | Published05/25/2017 | SeverityUnknown |
CVE-2016-0781CVE-2016-0781 | Exploitation statusNot confirmed | FixNot confirmed | Affected productCloud Foundry | Published05/25/2017 | SeverityUnknown |
CVE-2016-0780CVE-2016-0780 | Exploitation statusNot confirmed | FixNot confirmed | Affected productCloud Foundry | Published05/25/2017 | SeverityUnknown |
CVE-2015-3190CVE-2015-3190 | Exploitation statusNot confirmed | FixNot confirmed | Affected productCloud Foundry | Published05/25/2017 | SeverityUnknown |
CVE-2015-1834CVE-2015-1834 | Exploitation statusNot confirmed | FixNot confirmed | Affected productCloud Foundry | Published05/25/2017 | SeverityUnknown |
CVE-2016-0928CVE-2016-0928 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/18/2016 | SeverityUnknown |
CVE-2016-6639CVE-2016-6639 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/18/2016 | SeverityUnknown |
CVE-2016-0930CVE-2016-0930 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/18/2016 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
.svg){kind=icon}
.svg){kind=icon}
.svg){kind=icon}
