← Back

Login Server

login-server

Vendor: Pivotal Software • 2 CVEs

CVEs (2)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2016-3084
2Cloudfoundry
Pivotal Software
5Cloud Foundry
Cloud Foundry Elastic RuntimeCloud Foundry Uaa+2 more
May 13, 2026
May 25, 2017
N/A· v4
8.1 HIGH· v3
4.3 MEDIUM· v2
The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA release v10 and earlier versions and Pivotal Elastic Runtime vers...Show more
The UAA reset password flow in Cloud Foundry release v236 and earlier versions, UAA release v3.3.0 and earlier versions, all versions of Login-server, UAA release v10 and earlier versions and Pivotal Elastic Runtime versions prior to 1.7.2 is vulnerable to a brute force attack due to multiple active codes at a given time. This vulnerability is applicable only when using the UAA internal user store for authentication. Deployments enabled for integration via SAML or LDAP are not affected.Show less
CVE-2016-0781
2Cloudfoundry
Pivotal Software
5Cloud Foundry
Cloud Foundry Elastic RuntimeCloud Foundry Uaa+2 more
May 13, 2026
May 25, 2017
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The UAA OAuth approval pages in Cloud Foundry v208 to v231, Login-server v1.6 to v1.14, UAA v2.0.0 to v2.7.4.1, UAA v3.0.0 to v3.2.0, UAA-Release v2 to v7 and Pivotal Elastic Runtime 1.6.x versions prior to 1.6.20 are vu...Show more
The UAA OAuth approval pages in Cloud Foundry v208 to v231, Login-server v1.6 to v1.14, UAA v2.0.0 to v2.7.4.1, UAA v3.0.0 to v3.2.0, UAA-Release v2 to v7 and Pivotal Elastic Runtime 1.6.x versions prior to 1.6.20 are vulnerable to an XSS attack by specifying malicious java script content in either the OAuth scopes (SCIM groups) or SCIM group descriptions.Show less