Pivotal vulnerabilitiesNone on the known-exploited list.
Pivotal has 30 published vulnerabilities across 41 products in our catalogue. None of them is on the list of flaws known to be exploited today. The most affected product is Reactor Netty, with 6. If you run Pivotal software, patch the exploited flaws first.
We keep watching the known-exploited list.
Which Pivotal products have the most vulnerabilities?
Reactor Netty leads with 6 published vulnerabilities. Open a product to see its versions and which of its flaws criminals are already using.
Which Pivotal vulnerabilities are being exploited?
This is the list that matters most: flaws criminals are using now.
None of Pivotal's published vulnerabilities is on the list of flaws known to be exploited today. We keep watching that list.
Which Pivotal flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 79%CVE-2016-4977High
When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the response_type parameter value was executed as Spring SpEL which enabled a malicious...
- 15%CVE-2017-4971Medium
An issue was discovered in Pivotal Spring Web Flow through 2.4.4.
- 6.3%CVE-2017-3203High
The Java implementations of AMF3 deserializers in Pivotal/Spring Spring-flex derive class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable.
- 2.1%CVE-2019-19029High
Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via user-groups in the VMware Harbor Container Registry for the Pivotal Platform.
- 2.1%CVE-2019-3800High
CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag.
- 1.7%CVE-2016-6639High
Cloud Foundry PHP Buildpack (aka php-buildpack) before 4.3.18 and PHP Buildpack Cf-release before 242, as used in Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.38 and 1.7.x before 1.7.19 and other products,...
- 1.6%CVE-2019-19023High
Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 has a Privilege Escalation Vulnerability in the VMware Harbor Container Registry for the Pivotal Platform.
- 1.4%CVE-2019-19026Medium
Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via project quotas in the VMware Harbor Container Registry for the Pivotal Platform.
- 1.4%CVE-2016-0928High
Multiple open redirect vulnerabilities in Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.30 and 1.7.x before 1.7.8 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks...
- 1.3%CVE-2022-22969Medium
<Issue Description> Spring Security OAuth versions 2.5.x prior to 2.5.2 and older unsupported versions are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth...
All Pivotal products we track.
36 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.
- Reactor Nettyreactor_netty6 vulnerabilities121 versions
- Cloud Foundry Deploymentcloud_foundry_deployment2 vulnerabilities146 versions
- Cloud Foundry Elastic Runtimecloud_foundry_elastic_runtime2 vulnerabilities20 versions
- Cloud Foundry Notificationscloud_foundry_notifications2 vulnerabilities2 versions
- Cloud Foundry Routing Releasecloud_foundry_routing_release2 vulnerabilities66 versions
- Spring Security Oauthspring_security_oauth2 vulnerabilities17 versions
- Spring Web Flowspring_web_flow2 vulnerabilities5 versions
- Apps Managerapps_manager1 vulnerability10 versions
- Bosh Stemcellbosh_stemcell1 vulnerability3 versions
- Capi-Releasecapi-release1 vulnerability9 versions
- Cloud Foundry Autoscaling Releasecloud_foundry_autoscaling_release1 vulnerability9 versions
- Cloud Foundry Command Line Interfacecloud_foundry_command_line_interface1 vulnerability82 versions
- Cloud Foundry Command Line Interface Releasecloud_foundry_command_line_interface_release1 vulnerability18 versions
- Cloud Foundry Container Runtimecloud_foundry_container_runtime1 vulnerability33 versions
- Cloud Foundry Deployment Concourse Taskscloud_foundry_deployment_concourse_tasks1 vulnerability116 versions
- Cloud Foundry Event Alertscloud_foundry_event_alerts1 vulnerability6 versions
- Cloud Foundry Healthwatchcloud_foundry_healthwatch1 vulnerability8 versions
- Cloud Foundry Log Cache Releasecloud_foundry_log_cache_release1 vulnerability34 versions
- Cloud Foundry Networking Releasecloud_foundry_networking_release1 vulnerability85 versions
- Cloud Foundry NFS Volumecloud_foundry_nfs_volume1 vulnerability4 versions
- Cloud Foundry SMB Volumecloud_foundry_smb_volume1 vulnerability1 version
- Cloud Foundry Smoke Testcloud_foundry_smoke_test1 vulnerability1 version
- Credhub Service Broker for Pcfcredhub_service_broker_for_pcf1 vulnerability7 versions
- Elastic Runtimeelastic_runtime1 vulnerability14 versions
This directory lists the 36 Pivotal products with at least one tracked version, of 41 in our catalogue.
Running Pivotal? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 new flaw affects software Acme tracks
When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the response_type parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the crafting of the value for response_type.
- Matched to
- Spring Security Oauth on Acme's software list
- What to do
- Plan in the vendor’s update
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
Our catalogue lists 30 published vulnerabilities across 41 products and 935 versions from Pivotal.
None of Pivotal's vulnerabilities is on the list of flaws known to be exploited today.
Reactor Netty, with 6 published vulnerabilities. Its own page lists the ones known to be exploited.
Create a Precursor Intelligence account and track the Pivotal products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.