[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ftp8MZCU68wEzLmfS5tKA6uUJ51q_xLxKvWCP6_XgoJs":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":279,"kevVulnerabilities":341,"topProductsByCves":347,"seoMetadata":358,"meta":367},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":278},24886,"pivotal_software",57,144,1,4813,"2022-12-19","p",[16,23,29,35,41,46,51,57,62,67,73,79,84,89,94,99,103,109,114,119,124,128,131,136,141,146,150,154,159,163,167,171,175,179,182,186,189,193,198,202,207,211,215,219,223,228,233,237,242,247,251,256,260,263,267,271,275],{"id":17,"product_name":18,"version_count":19,"cve_count":20,"kev_count":21,"last_cve_update":22},129294,"cloud_foundry_uaa",398,32,0,"2019-10-23",{"id":24,"product_name":25,"version_count":26,"cve_count":27,"kev_count":21,"last_cve_update":28},129288,"cloud_foundry_elastic_runtime",169,28,"2018-09-11",{"id":30,"product_name":31,"version_count":32,"cve_count":33,"kev_count":21,"last_cve_update":34},129314,"rabbitmq",321,11,"2020-08-31",{"id":36,"product_name":37,"version_count":38,"cve_count":39,"kev_count":21,"last_cve_update":40},129310,"operations_manager",267,10,"2020-01-09",{"id":42,"product_name":43,"version_count":44,"cve_count":39,"kev_count":21,"last_cve_update":45},129326,"spring_framework",159,"2020-01-10",{"id":47,"product_name":48,"version_count":49,"cve_count":39,"kev_count":21,"last_cve_update":50},129282,"cloud_foundry",36,"2017-05-25",{"id":52,"product_name":53,"version_count":54,"cve_count":55,"kev_count":21,"last_cve_update":56},129297,"cloud_foundry_uaa-release",157,8,"2019-07-11",{"id":58,"product_name":59,"version_count":60,"cve_count":61,"kev_count":21,"last_cve_update":13},129300,"concourse",222,7,{"id":63,"product_name":64,"version_count":65,"cve_count":61,"kev_count":21,"last_cve_update":66},129311,"pivotal_application_service",494,"2019-10-01",{"id":68,"product_name":69,"version_count":70,"cve_count":71,"kev_count":21,"last_cve_update":72},129291,"cloud_foundry_ops_manager",30,5,"2017-04-11",{"id":74,"product_name":75,"version_count":76,"cve_count":77,"kev_count":11,"last_cve_update":78},129325,"spring_data_rest",79,4,"2018-05-11",{"id":80,"product_name":81,"version_count":82,"cve_count":77,"kev_count":21,"last_cve_update":83},129277,"application_service",109,"2019-08-19",{"id":85,"product_name":86,"version_count":87,"cve_count":77,"kev_count":21,"last_cve_update":88},129331,"spring_security_oauth",45,"2019-06-12",{"id":90,"product_name":91,"version_count":92,"cve_count":77,"kev_count":21,"last_cve_update":93},129330,"spring_security",99,"2021-02-23",{"id":95,"product_name":96,"version_count":21,"cve_count":97,"kev_count":21,"last_cve_update":98},129283,"cloud_foundry_cf",3,"2017-07-10",{"id":100,"product_name":101,"version_count":102,"cve_count":97,"kev_count":11,"last_cve_update":78},129321,"spring_data_commons",81,{"id":104,"product_name":105,"version_count":106,"cve_count":107,"kev_count":21,"last_cve_update":108},129333,"windows_stemcells",19,2,"2018-05-17",{"id":110,"product_name":111,"version_count":112,"cve_count":107,"kev_count":21,"last_cve_update":113},129284,"cloud_foundry_cf-deployment",156,"2020-02-12",{"id":115,"product_name":116,"version_count":117,"cve_count":107,"kev_count":21,"last_cve_update":118},129286,"cloud_foundry_cf-release",214,"2018-02-01",{"id":120,"product_name":121,"version_count":122,"cve_count":107,"kev_count":21,"last_cve_update":123},129299,"cloudfoundry_uaa_release",148,"2018-11-19",{"id":125,"product_name":126,"version_count":61,"cve_count":107,"kev_count":21,"last_cve_update":127},129304,"gemfire_for_pivotal_cloud_foundry","2018-03-16",{"id":129,"product_name":130,"version_count":21,"cve_count":107,"kev_count":21,"last_cve_update":50},129308,"login-server",{"id":132,"product_name":133,"version_count":134,"cve_count":107,"kev_count":21,"last_cve_update":135},129313,"pivotal_container_service",40,"2019-07-23",{"id":137,"product_name":138,"version_count":139,"cve_count":107,"kev_count":21,"last_cve_update":140},129317,"spring_advanced_message_queuing_protocol",89,"2018-09-14",{"id":142,"product_name":143,"version_count":144,"cve_count":107,"kev_count":21,"last_cve_update":145},129318,"spring_batch",61,"2020-06-11",{"id":147,"product_name":148,"version_count":21,"cve_count":107,"kev_count":21,"last_cve_update":149},129319,"spring_batch_admin","2018-03-21",{"id":151,"product_name":152,"version_count":71,"cve_count":11,"kev_count":21,"last_cve_update":153},129302,"credhub_service_broker","2018-11-13",{"id":155,"product_name":156,"version_count":157,"cve_count":11,"kev_count":21,"last_cve_update":158},129328,"spring-ldap",13,"2017-11-27",{"id":160,"product_name":161,"version_count":21,"cve_count":11,"kev_count":21,"last_cve_update":162},129305,"greenplum","2016-12-16",{"id":164,"product_name":165,"version_count":166,"cve_count":11,"kev_count":21,"last_cve_update":78},129306,"greenplum_command_center",43,{"id":168,"product_name":169,"version_count":70,"cve_count":11,"kev_count":21,"last_cve_update":170},129307,"grootfs","2017-11-13",{"id":172,"product_name":173,"version_count":11,"cve_count":11,"kev_count":21,"last_cve_update":174},129324,"spring_data_jpa","2016-10-05",{"id":176,"product_name":177,"version_count":107,"cve_count":11,"kev_count":21,"last_cve_update":178},129285,"cloud_foundry_cf_mysql","2016-10-06",{"id":180,"product_name":181,"version_count":11,"cve_count":11,"kev_count":21,"last_cve_update":158},129281,"cf-deployment",{"id":183,"product_name":184,"version_count":20,"cve_count":11,"kev_count":21,"last_cve_update":185},129295,"cloudfoundry_uaa","2018-10-05",{"id":187,"product_name":188,"version_count":71,"cve_count":11,"kev_count":21,"last_cve_update":22},129293,"cloud_foundry_smb_volume",{"id":190,"product_name":191,"version_count":192,"cve_count":11,"kev_count":21,"last_cve_update":158},129301,"credhub-release",93,{"id":194,"product_name":195,"version_count":196,"cve_count":11,"kev_count":21,"last_cve_update":197},129303,"gemfire",20,"2018-04-18",{"id":199,"product_name":200,"version_count":201,"cve_count":11,"kev_count":21,"last_cve_update":123},129309,"on_demand_services_sdk",37,{"id":203,"product_name":204,"version_count":205,"cve_count":11,"kev_count":21,"last_cve_update":206},129290,"cloud_foundry_nfs_volume",58,"2018-12-05",{"id":208,"product_name":209,"version_count":20,"cve_count":11,"kev_count":21,"last_cve_update":210},129312,"pivotal_cloud_cache","2018-09-17",{"id":212,"product_name":213,"version_count":214,"cve_count":11,"kev_count":21,"last_cve_update":123},129280,"broker_api",16,{"id":216,"product_name":217,"version_count":218,"cve_count":11,"kev_count":21,"last_cve_update":185},129289,"cloud_foundry_log_cache",17,{"id":220,"product_name":221,"version_count":11,"cve_count":11,"kev_count":21,"last_cve_update":222},129315,"rabbitmq_management","2015-01-18",{"id":224,"product_name":225,"version_count":226,"cve_count":11,"kev_count":21,"last_cve_update":227},129279,"bosh_cli",166,"2018-03-27",{"id":229,"product_name":230,"version_count":231,"cve_count":11,"kev_count":21,"last_cve_update":232},129332,"spring_web_services",51,"2019-01-18",{"id":234,"product_name":235,"version_count":21,"cve_count":11,"kev_count":21,"last_cve_update":236},129278,"bits_service","2018-11-09",{"id":238,"product_name":239,"version_count":240,"cve_count":11,"kev_count":21,"last_cve_update":241},129287,"cloud_foundry_diego",421,"2018-06-06",{"id":243,"product_name":244,"version_count":245,"cve_count":11,"kev_count":21,"last_cve_update":246},129322,"spring_data_java_persistance_api",106,"2019-06-03",{"id":248,"product_name":249,"version_count":21,"cve_count":11,"kev_count":21,"last_cve_update":250},129323,"spring_data_java_persistence_api","2019-05-06",{"id":252,"product_name":253,"version_count":254,"cve_count":21,"kev_count":21,"last_cve_update":255},129329,"spring_ldap",12,null,{"id":257,"product_name":258,"version_count":259,"cve_count":21,"kev_count":21,"last_cve_update":255},129320,"spring_boot",55,{"id":261,"product_name":262,"version_count":254,"cve_count":21,"kev_count":21,"last_cve_update":255},129292,"cloud_foundry_php_buildpack",{"id":264,"product_name":265,"version_count":266,"cve_count":21,"kev_count":21,"last_cve_update":255},129316,"redis",27,{"id":268,"product_name":269,"version_count":270,"cve_count":21,"kev_count":21,"last_cve_update":255},129296,"cloud_foundry_uaa_bosh",47,{"id":272,"product_name":273,"version_count":274,"cve_count":21,"kev_count":21,"last_cve_update":255},129327,"spring_integration",103,{"id":276,"product_name":277,"version_count":61,"cve_count":21,"kev_count":21,"last_cve_update":255},129298,"cloud_foundry_uaa_release","Pivotal_software is a technology vendor with 57 tracked products and 144 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[280,288,297,303,309,313,318,323,329,334],{"cveId":281,"description":282,"publishedDate":283,"cvssScore":284,"cvssVersion":285,"severity":286,"isKev":4,"epssScore":287},"CVE-2018-1273","Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.","2018-04-11",9.8,"v3.1","Critical",0.96956,{"cveId":289,"description":290,"publishedDate":291,"cvssScore":292,"cvssVersion":293,"severity":294,"isKev":295,"epssScore":296},"CVE-2013-6429","The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.","2014-01-26",6.8,"v2","Medium",false,0.9056,{"cveId":298,"description":299,"publishedDate":300,"cvssScore":284,"cvssVersion":301,"severity":286,"isKev":295,"epssScore":302},"CVE-2017-8046","Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.","2018-01-04","v3.0",0.7453,{"cveId":304,"description":305,"publishedDate":306,"cvssScore":307,"cvssVersion":285,"severity":294,"isKev":295,"epssScore":308},"CVE-2019-3778","Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the \"redirect_uri\" parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code. This vulnerability exposes applications that meet all of the following requirements: Act in the role of an Authorization Server (e.g. @EnableAuthorizationServer) and uses the DefaultRedirectResolver in the AuthorizationEndpoint. This vulnerability does not expose applications that: Act in the role of an Authorization Server and uses a different RedirectResolver implementation other than DefaultRedirectResolver, act in the role of a Resource Server only (e.g. @EnableResourceServer), act in the role of a Client only (e.g. @EnableOAuthClient).","2019-03-07",6.5,0.16596,{"cveId":310,"description":311,"publishedDate":78,"cvssScore":284,"cvssVersion":301,"severity":286,"isKev":295,"epssScore":312},"CVE-2018-1260","Spring Security OAuth, versions 2.3 prior to 2.3.3, 2.2 prior to 2.2.2, 2.1 prior to 2.1.2, 2.0 prior to 2.0.15 and older unsupported versions contains a remote code execution vulnerability. A malicious user or attacker can craft an authorization request to the authorization endpoint that can lead to remote code execution when the resource owner is forwarded to the approval endpoint.",0.10813,{"cveId":314,"description":315,"publishedDate":316,"cvssScore":71,"cvssVersion":293,"severity":294,"isKev":295,"epssScore":317},"CVE-2014-3625","Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling.","2014-11-20",0.10323,{"cveId":319,"description":320,"publishedDate":88,"cvssScore":321,"cvssVersion":285,"severity":294,"isKev":295,"epssScore":322},"CVE-2019-11269","Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the redirect_uri parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code.",5.4,0.08906,{"cveId":324,"description":325,"publishedDate":326,"cvssScore":327,"cvssVersion":293,"severity":294,"isKev":295,"epssScore":328},"CVE-2014-1904","Cross-site scripting (XSS) vulnerability in web\u002Fservlet\u002Ftags\u002Fform\u002FFormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.","2014-03-20",4.3,0.06896,{"cveId":330,"description":331,"publishedDate":332,"cvssScore":71,"cvssVersion":293,"severity":294,"isKev":295,"epssScore":333},"CVE-2014-3578","Directory traversal vulnerability in Pivotal Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5 allows remote attackers to read arbitrary files via a crafted URL.","2015-02-19",0.06334,{"cveId":335,"description":336,"publishedDate":337,"cvssScore":338,"cvssVersion":301,"severity":339,"isKev":295,"epssScore":340},"CVE-2016-9878","An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5. Paths provided to the ResourceServlet were not properly sanitized and as a result exposed to directory traversal attacks.","2016-12-29",7.5,"High",0.05748,[342],{"cveId":281,"description":282,"publishedDate":283,"cvssScore":284,"cvssVersion":285,"severity":286,"isKev":4,"epssScore":287,"cisaVulnName":343,"cisaDateAdded":344,"cisaShortDescription":345,"cisaRequiredAction":346},"VMware Tanzu Spring Data Commons Property Binder Vulnerability","2022-03-25","Spring Data Commons contains a property binder vulnerability which can allow an attacker to perform remote code execution.","Apply updates per vendor instructions.",[348,349,350,351,352,353,354,355,356,357],{"id":17,"product_name":18,"version_count":19,"cve_count":20,"kev_count":21,"last_cve_update":22},{"id":24,"product_name":25,"version_count":26,"cve_count":27,"kev_count":21,"last_cve_update":28},{"id":30,"product_name":31,"version_count":32,"cve_count":33,"kev_count":21,"last_cve_update":34},{"id":36,"product_name":37,"version_count":38,"cve_count":39,"kev_count":21,"last_cve_update":40},{"id":42,"product_name":43,"version_count":44,"cve_count":39,"kev_count":21,"last_cve_update":45},{"id":47,"product_name":48,"version_count":49,"cve_count":39,"kev_count":21,"last_cve_update":50},{"id":52,"product_name":53,"version_count":54,"cve_count":55,"kev_count":21,"last_cve_update":56},{"id":58,"product_name":59,"version_count":60,"cve_count":61,"kev_count":21,"last_cve_update":13},{"id":63,"product_name":64,"version_count":65,"cve_count":61,"kev_count":21,"last_cve_update":66},{"id":68,"product_name":69,"version_count":70,"cve_count":71,"kev_count":21,"last_cve_update":72},{"title":359,"metaDescription":360,"keywords":361,"structuredData":362},"Pivotal_software - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Pivotal_software covering 57 products with 144 tracked vulnerabilities including 1 critical and 0 high-severity issues and 1 CISA KEV vulnerability. Real-time threat intelligence, CVE tracking, and security recommendations.","Pivotal_software vulnerabilities, Pivotal_software security, Pivotal_software CVE, Pivotal_software threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking, Pivotal_software KEV, Pivotal_software exploited vulnerabilities",{"@context":363,"@type":364,"name":365,"description":360,"url":366},"https:\u002F\u002Fschema.org","Organization","Pivotal_software","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fpivotal_software",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":368,"apiVersion":369},"2026-10-20T21:52:36.560Z","3.0"]