Filtered by vendor Cloudfoundry Subscriptions
Filtered by product Credhub Subscriptions
Total 2 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2020-5399 2 Cloudfoundry, Pivotal Software 2 Credhub, Cloud Foundry Cf-deployment 2024-11-21 7.4 High
Cloud Foundry CredHub, versions prior to 2.5.10, connects to a MySQL database without TLS even when configured to use TLS. A malicious user with access to the network between CredHub and its MySQL database may eavesdrop on database connections and thereby gain unauthorized access to CredHub and other components.
CVE-2019-3801 1 Cloudfoundry 3 Cf-deployment, Credhub, Uaa Release 2024-11-21 9.8 Critical
Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an insecure protocol to fetch dependencies when building. A remote unauthenticated malicious attacker could hijack the DNS entry for the dependency, and inject malicious code into the component.