2019-04-24

2019-04-25

2019-04-26

All (2) Critical (2) High (12) Medium (19) Low (1)

CVE-2019-9901 CRITICAL PATCH Act Now

Envoy 1.9.0 and before does not normalize HTTP URL paths. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Authentication Bypass Envoy

NVD GitHub

CVSS 3.0

10.0

EPSS

2.7%

CVE-2019-3801 CRITICAL Act Now

Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an insecure protocol to fetch dependencies when building. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Code Injection Java Cf Deployment Credhub Uaa Release

NVD

CVSS 3.1

9.8

EPSS

0.6%