Cloud Foundry Bosh

An issue was discovered in Cloud Foundry Foundation BOSH Release 261.x versions prior to 261.3 and all 260.x versions. In certain cases an authenticated Director user can provide a malicious checksum that could allow them to escalate their privileges on the Director VM, aka "BOSH Director Shell Injection Vulnerabilities."

Bosh accepts refresh tokens in place of an access token

Bosh Deployment logs leak sensitive information

Compromised VM can make arbitrary blobstore deletes

Local Blobstore may allow arbitrary reads/deletes