Information Disclosure

Every one of the 27 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Log Cache logs UAA client secret on startupCVE-2018-1264Cloud Foundry · CVSS 9.1 · 1.8% likely

   CWE-532

2. An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v250 and CAPI-release versions prior to v1.12.0. Cloud Foundry logs the credentials returned from…CVE-2016-9882Cloudfoundry · 1.7% likely

   CWE-532

3. NFS Volume release errand leaks cf admin credentials in logsCVE-2018-15797Cloud Foundry · CVSS 8.4 · 1.6% likely

   CWE-532

4. Applications deployed to Cloud Foundry, versions v166 through v227, may be vulnerable to a remote disclosure of information, including, but not limited to environment variables an…CVE-2016-0708Cloud Foundry · 1.6% likely

   CWE-200

5. Password leak in smbdriver logsCVE-2019-11283Cloud Foundry · CVSS 8.8 · 1.5% likely

   CWE-532

6. In Cloud Foundry Foundation CAPI-release versions after v1.6.0 and prior to v1.38.0 and cf-release versions after v244 and prior to v270, there is an incomplete fix for CVE-2017-8…CVE-2017-8037Cloudfoundry · 1.4% likely

   CWE-200

7. An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release versions after v1.6.0 and prior to v1.35.0 and cf-release versions after v244 and prio…CVE-2017-8035Cloudfoundry · 1.4% likely

   CWE-200

8. CF CLI does not sanitize user's password in verbose/trace/debugCVE-2019-3781Cloud Foundry · CVSS 8.2 · 1.3% likely

   CWE-215

9. UAA logs all query parameters with debug logging levelCVE-2019-11293Cloud Foundry · CVSS 8.8 · 1.3% likely

   CWE-532

10. Cloud Foundry UAA logs query parameters in tomcat access fileCVE-2019-11290Cloud Foundry · CVSS 8.8 · 1.3% likely

    CWE-532

11. UAA is vulnerable to a Blind SCIM injection leading to information disclosureCVE-2019-11282Cloud Foundry · CVSS 4.3 · 1.1% likely

    CWE-200

12. Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact via vectors…CVE-2015-5173Cloudfoundry · 1.0% likely

    CWE-200

13. Windows 2012R2 stemcells, versions prior to 1200.17, contain an information exposure vulnerability on vSphere. A remote user with the ability to push apps can execute crafted comm…CVE-2018-1276Cloud Foundry · 1.0% likely

    CWE-200

14. UAA SQL Identity Zone VulnerabilityCVE-2019-11268Cloud Foundry · CVSS 6.5 · 1.0% likely

    CWE-200

15. In UAA versions prior to 75.3.0, sensitive information like relaying secret of the provider was revealed in response when deletion request of an identity provider( IdP) of type “o…CVE-2021-22001Cloudfoundry · 1.0% likely

    CWE-200

16. Cloud Foundry Container Runtime (kubo-release), versions prior to 0.14.0, may leak UAA and vCenter credentials to application logs. A malicious user with the ability to read the a…CVE-2018-1223Cloud Foundry · 0.9% likely

    CWE-532

17. Timing attack allows extraction of signing key in Bits ServiceCVE-2018-15800Cloud Foundry · CVSS 8.1 · 0.9% likely

    CWE-200

18. UAA password may appear in BOSH System Metrics Server process argumentsCVE-2020-5422Cloud Foundry · 0.9% likely

    CWE-214

19. Cloud Foundry Garden-runC, versions prior to 1.11.0, contains an information exposure vulnerability. A user with access to Garden logs may be able to obtain leaked credentials and…CVE-2018-1191Cloud Foundry · 0.9% likely

    CWE-215

20. Applications in cf-release before 245 can be configured and pushed with a user-provided custom buildpack using a URL pointing to the buildpack. Although it is not recommended, a u…CVE-2016-6658Cloudfoundry · 0.9% likely

    CWE-200

21. CAPI leaks service broker URLs and GUIDs to space developersCVE-2019-11294Cloud Foundry · CVSS 4.3 · 0.8% likely

    CWE-200

22. CF workflows leak credentials in system audit logsCVE-2023-20885Cloud Foundry · CVSS 6.5 · 0.5% likely

    CWE-532

23. Cloud Foundry UAA versions v76.12.0 through v78.12.0 are vulnerable to a private key exposure. The server contains a vulnerability where EC (Elliptic Curve) private keys are inadv…CVE-2026-40965Cloud Foundry Foundation · CVSS 10 · 0.3% likelycovered by CyberSIXT

    CWE-200

24. Cloud Controller exposes secrets in audit logCVE-2026-59388Cloud Foundry Foundation · CVSS 6.5 · 0.3% likely

    CWE-532

25. Bosh Deployment logs leak sensitive informationCVE-2019-11271Cloud Foundry · CVSS 6 · 0.3% likely

    CWE-532

26. OpenStack Application Credentials Logged in Cleartext to BOSH Debug LogsCVE-2026-47832CloudFoundry Foundation · CVSS 7.3 · 0.2% likely

    CWE-532

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.