VMware Tanzu
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| Concourse | 1 | – | Aug 12, 2020 |
| Operations Manager | 1 | – | Jul 31, 2020 |
| PCF Autoscaling | 1 | – | Jul 31, 2020 |
| Pivotal Scheduler | 1 | – | Nov 11, 2020 |
| RabbitMQ | 1 | – | Aug 31, 2020 |
| Single Sign-On for VMware Tanzu | 1 | – | Oct 31, 2020 |
| VMware GemFire | 1 | – | Jul 31, 2020 |
| VMware Tanzu Application Service for VMs | 1 | – | Jul 31, 2020 |
| VMware Tanzu GemFire for VMs | 1 | – | Jul 31, 2020 |
Exploited and recent CVEs
- CVE-2020-5426 Scheduler for TAS can transmit privileged UAA token in plaintext 0.7%
- CVE-2020-5425 User Impersonation possible in Tanzu SSO 0.7%
- CVE-2020-5419 RabbitMQ arbitrary code execution using local binary planting 0.5%
- CVE-2020-5415 Concourse's GitLab auth allows impersonation 1.2%
- CVE-2020-5414 App Autoscaler logs credentials 0.7%
- CVE-2020-5414 App Autoscaler logs credentials 0.7%
- CVE-2020-5414 App Autoscaler logs credentials 0.7%
- CVE-2020-5396 JMX Insecure Default Configuration in GemFire 1.9%
- CVE-2020-5396 JMX Insecure Default Configuration in GemFire 1.9%