Operations manager

This hub aggregates every CVE we track for Operations manager, a product in the enterprise software space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Operations manager.

• CVE-2020-5414App Autoscaler logs credentials5.7Jul 31, 2020
• CVE-2019-11292Pivotal Ops Manager logs query parameters in tomcat access file6.5Jan 8, 2020
• CVE-2019-11270UAA clients.write vulnerability7.5Aug 5, 2019
• CVE-2019-3790Ops Manager uaa client issues tokens after refresh token expiration6.1Jun 6, 2019
• CVE-2019-3776Reflected XSS in Pivotal Operations Manager7.2Mar 7, 2019
• CVE-2018-15762Pivotal Operations Manager gives all users heightened privileges9.0Nov 2, 2018
• CVE-2018-11081Pivotal Operations Manager UAA config - temp Ram Disk7.9Oct 5, 2018
• CVE-2018-11045Pivotal Operations Manager, versions 2.1 prior to 2.1.6 and 2.0 prior to 2.0.15 and 1.12 prior to 1.12.22, contains a static Linux Random Number Generator (LRNG) seed file embedded in the appliance...5.9Jul 11, 2018
• CVE-2018-11046Pivotal Operations Manager, versions 2.1.x prior to 2.1.6 and version 2.0.14, includes NGINX packages that lacks security vulnerability patches. An attacker with access to the NGINX processes and k...6.5Jun 25, 2018
• CVE-2016-0930Pivotal Cloud Foundry (PCF) Ops Manager before 1.6.19 and 1.7.x before 1.7.10, when vCloud or vSphere is used, has a default password for compilation VMs, which allows remote attackers to obtain SS...9.8Sep 18, 2016
• CVE-2016-0897Pivotal Cloud Foundry (PCF) Ops Manager before 1.6.17 and 1.7.x before 1.7.8, when vCloud or vSphere is used, does not properly enable SSH access for operators, which has unspecified impact and rem...9.8Sep 18, 2016
• CVE-2016-0883Pivotal Cloud Foundry (PCF) Ops Manager before 1.5.14 and 1.6.x before 1.6.9 uses the same cookie-encryption key across different customers' installations, which allows remote attackers to bypass s...9.8Sep 18, 2016
• CVE-2016-4380Cross-site scripting (XSS) vulnerability in the AdminUI in HPE Operations Manager 9.21.x before 9.21.130 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vec...5.4Sep 8, 2016
• CVE-2016-4373The AdminUI in HPE Operations Manager (OM) before 9.21.130 on Linux, Unix, and Solaris allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apa...9.8Aug 1, 2016
• CVE-2016-1985HPE Operations Manager 8.x and 9.0 on Windows allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.10.0Jan 30, 2016