CVE-2016-9880

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The GemFire broker for Cloud Foundry 1.6.x before 1.6.5 and 1.7.x before 1.7.1 has multiple API endpoints which do not require authentication and could be used to gain access to the cluster managed by the broker.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
Dell EMC	GemFire broker for Cloud Foundry	1.6.x versions prior to 1.6.5; 1.7.x versions prior to 1.7.1

References

http://www.securityfocus.com/bid/96146Third Party Advisory, VDB Entry
https://pivotal.io/security/cve-2016-9880Vendor Advisory
http://www.securityfocus.com/bid/96146Third Party Advisory, VDB Entry
https://pivotal.io/security/cve-2016-9880Vendor Advisory

Timeline

Published: Mar 16, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-98827.5An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v250 and CAPI-release versions prior to v1.12.0. Cloud Foun CVE-2016-98859.8An issue was discovered in Pivotal GemFire for PCF 1.6.x versions prior to 1.6.5 and 1.7.x versions prior to 1.7.1. The gfsh (Geode Shell) e CVE-2016-98885.5An error within the "tar_directory_for_file()" function (gsf-infile-tar.c) in GNOME Structured File Library before 1.14.41 can be exploited CVE-2016-98896.1Some forms with the parameter geo_zoomlevel_to_found_location in Tiki Wiki CMS 12.x before 12.10 LTS, 15.x before 15.3 LTS, and 16.x before CVE-2016-98915.4Cross-site scripting (XSS) vulnerability in admin/media.php and admin/media_item.php in Dotclear before 2.11 allows remote authenticated use CVE-2016-98925.9The esets_daemon service in ESET Endpoint Antivirus for macOS before 6.4.168.0 and Endpoint Security for macOS before 6.4.168.0 does not pro CVE-2016-98939.8Memory safety bugs were reported in Thunderbird 45.5. Some of these bugs showed evidence of memory corruption and we presume that with enoug CVE-2016-98947.5A buffer overflow in SkiaGl caused when a GrGLBuffer is truncated during allocation. Later writers will overflow the buffer, resulting in a CVE-2016-98956.1Event handlers on "marquee" elements were executed despite a strict Content Security Policy (CSP) that disallowed inline JavaScript. This vu CVE-2016-98968.1Use-after-free while manipulating the "navigator" object within WebVR. Note: WebVR is not currently enabled by default. This vulnerability a CVE-2016-98977.5Memory corruption resulting in a potentially exploitable crash during WebGL functions using a vector constructor with a varying array within CVE-2016-98989.8Use-after-free resulting in potentially exploitable crash when manipulating DOM subtrees in the Editor. This vulnerability affects Firefox <