2019-04-24

2019-04-25

2019-04-26

All (2) Critical (2) High (12) Medium (19) Low (1)

CVE-2019-9901 Apr 25, 16:29 CRITICAL PATCH Act Now

Envoy 1.9.0 and before does not normalize HTTP URL paths. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Authentication Bypass Envoy Envoyproxy

NVD GitHub

CVSS 3.0

10.0

EPSS

2.7%

CVE-2019-3801 Apr 25, 21:29 CRITICAL Act Now

Cloud Foundry cf-deployment, versions prior to 7.9.0, contain java components that are using an insecure protocol to fetch dependencies when building. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Java Code Injection Cf Deployment Uaa Release Credhub +1

NVD

CVSS 3.1

9.8

EPSS

0.6%