https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2020-5414.htmlhttps://patchthecve.com/cve/CVE-2020-5414.htmlWed, 17 Jun 2026 03:21:27 +0000MEDIUM 5.7: VMware Tanzu Application Service for VMs (2.7.x versions prior to 2.7.19, 2.8.x versions prior to 2.8.13, and 2.9.x versions prior to 2.9.7) contains an App Autoscaler that logs the UAA admin password. This credential is redacted on VMware Tanzu Operations Manager; however, the unredacted logs are ahttps://patchthecve.com/cve/CVE-2019-11292.htmlhttps://patchthecve.com/cve/CVE-2019-11292.htmlWed, 17 Jun 2026 02:12:41 +0000MEDIUM 6.5: Pivotal Ops Manager, versions 2.4.x prior to 2.4.27, 2.5.x prior to 2.5.24, 2.6.x prior to 2.6.16, and 2.7.x prior to 2.7.5, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials, then they will be logged as well.https://patchthecve.com/cve/CVE-2019-11270.htmlhttps://patchthecve.com/cve/CVE-2019-11270.htmlWed, 17 Jun 2026 02:12:38 +0000HIGH 7.5: Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or scope can bypass the restrictions imposed on clients created via 'clients.write' and create clients with arbitrary scopes that the creator does not possess.https://patchthecve.com/cve/CVE-2019-3790.htmlhttps://patchthecve.com/cve/CVE-2019-3790.htmlWed, 17 Jun 2026 02:35:36 +0000MEDIUM 6.1: The Pivotal Ops Manager, 2.2.x versions prior to 2.2.23, 2.3.x versions prior to 2.3.16, 2.4.x versions prior to 2.4.11, and 2.5.x versions prior to 2.5.3, contain configuration that circumvents refresh token expiration. A remote authenticated user can gain access to a browser session that was suppohttps://patchthecve.com/cve/CVE-2019-3776.htmlhttps://patchthecve.com/cve/CVE-2019-3776.htmlWed, 17 Jun 2026 02:35:34 +0000HIGH 7.2: Pivotal Operations Manager, 2.1.x versions prior to 2.1.20, 2.2.x versions prior to 2.2.16, 2.3.x versions prior to 2.3.10, 2.4.x versions prior to 2.4.3, contains a reflected cross site scripting vulnerability. A remote user that is able to convince an Operations Manager user to interact with malichttps://patchthecve.com/cve/CVE-2018-15762.htmlhttps://patchthecve.com/cve/CVE-2018-15762.htmlWed, 17 Jun 2026 01:43:04 +0000CRITICAL 9.0: Pivotal Operations Manager, versions 2.0.x prior to 2.0.24, versions 2.1.x prior to 2.1.15, versions 2.2.x prior to 2.2.7, and versions 2.3.x prior to 2.3.1, grants all users a scope which allows for privilege escalation. A remote malicious user who has been authenticated may create a new client withttps://patchthecve.com/cve/CVE-2018-11081.htmlhttps://patchthecve.com/cve/CVE-2018-11081.htmlWed, 17 Jun 2026 01:35:14 +0000HIGH 7.9: Pivotal Operations Manager, versions 2.2.x prior to 2.2.1, 2.1.x prior to 2.1.11, 2.0.x prior to 2.0.16, and 1.11.x prior to 2, fails to write the Operations Manager UAA config onto the temp RAM disk, thus exposing the configs directly onto disk. A remote user that has gained access to the Operationhttps://patchthecve.com/cve/CVE-2018-11045.htmlhttps://patchthecve.com/cve/CVE-2018-11045.htmlWed, 17 Jun 2026 01:35:09 +0000MEDIUM 5.9: Pivotal Operations Manager, versions 2.1 prior to 2.1.6 and 2.0 prior to 2.0.15 and 1.12 prior to 1.12.22, contains a static Linux Random Number Generator (LRNG) seed file embedded in the appliance image. An attacker with knowledge of the exact version and IaaS of a running OpsManager could get the https://patchthecve.com/cve/CVE-2018-11046.htmlhttps://patchthecve.com/cve/CVE-2018-11046.htmlWed, 17 Jun 2026 01:35:09 +0000MEDIUM 6.5: Pivotal Operations Manager, versions 2.1.x prior to 2.1.6 and version 2.0.14, includes NGINX packages that lacks security vulnerability patches. An attacker with access to the NGINX processes and knowledge of how to exploit the unpatched vulnerabilities may be able to impact Operations Managerhttps://patchthecve.com/cve/CVE-2016-0930.htmlhttps://patchthecve.com/cve/CVE-2016-0930.htmlWed, 17 Jun 2026 00:38:29 +0000CRITICAL 9.8: Pivotal Cloud Foundry (PCF) Ops Manager before 1.6.19 and 1.7.x before 1.7.10, when vCloud or vSphere is used, has a default password for compilation VMs, which allows remote attackers to obtain SSH access by connecting within an installation-time period during which these VMs exist.https://patchthecve.com/cve/CVE-2016-0897.htmlhttps://patchthecve.com/cve/CVE-2016-0897.htmlWed, 17 Jun 2026 00:38:25 +0000CRITICAL 9.8: Pivotal Cloud Foundry (PCF) Ops Manager before 1.6.17 and 1.7.x before 1.7.8, when vCloud or vSphere is used, does not properly enable SSH access for operators, which has unspecified impact and remote attack vectors.https://patchthecve.com/cve/CVE-2016-0883.htmlhttps://patchthecve.com/cve/CVE-2016-0883.htmlWed, 17 Jun 2026 00:38:24 +0000CRITICAL 9.8: Pivotal Cloud Foundry (PCF) Ops Manager before 1.5.14 and 1.6.x before 1.6.9 uses the same cookie-encryption key across different customers' installations, which allows remote attackers to bypass session authentication by leveraging knowledge of this key from another installation.https://patchthecve.com/cve/CVE-2016-4380.htmlhttps://patchthecve.com/cve/CVE-2016-4380.htmlWed, 17 Jun 2026 00:47:27 +0000MEDIUM 5.4: Cross-site scripting (XSS) vulnerability in the AdminUI in HPE Operations Manager 9.21.x before 9.21.130 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.https://patchthecve.com/cve/CVE-2016-4373.htmlhttps://patchthecve.com/cve/CVE-2016-4373.htmlWed, 17 Jun 2026 00:47:26 +0000CRITICAL 9.8: The AdminUI in HPE Operations Manager (OM) before 9.21.130 on Linux, Unix, and Solaris allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.https://patchthecve.com/cve/CVE-2016-1985.htmlhttps://patchthecve.com/cve/CVE-2016-1985.htmlWed, 17 Jun 2026 00:43:01 +0000CRITICAL 10.0: HPE Operations Manager 8.x and 9.0 on Windows allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.https://patchthecve.com/cve/CVE-2014-2649.htmlhttps://patchthecve.com/cve/CVE-2014-2649.htmlWed, 17 Jun 2026 00:06:58 +0000HIGH 7.5: Unspecified vulnerability in HP Operations Manager 9.20 on UNIX allows remote attackers to execute arbitrary code via unknown vectors.https://patchthecve.com/cve/CVE-2014-2648.htmlhttps://patchthecve.com/cve/CVE-2014-2648.htmlWed, 17 Jun 2026 00:06:58 +0000HIGH 10.0: Unspecified vulnerability in HP Operations Manager 9.10 and 9.11 on UNIX allows remote attackers to execute arbitrary code via unknown vectors.https://patchthecve.com/cve/CVE-2014-5073.htmlhttps://patchthecve.com/cve/CVE-2014-5073.htmlWed, 17 Jun 2026 00:10:59 +0000HIGH 7.5: vmtadmin.cgi in VMTurbo Operations Manager before 4.6 build 28657 allows remote attackers to execute arbitrary commands via shell metacharacters in the fileDate parameter in a DOWN call.https://patchthecve.com/cve/CVE-2014-3806.htmlhttps://patchthecve.com/cve/CVE-2014-3806.htmlWed, 17 Jun 2026 00:08:54 +0000MEDIUM 5.0: Directory traversal vulnerability in cgi-bin/help/doIt.cgi in VMTurbo Operations Manager before 4.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the xml_path parameter.