Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 403

Export CSV
CVE-2021-0341

okhttp: information disclosure via improperly used cryptographic function

In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-171980069

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Android Amq Streams Jboss Data Grid and 4 more
CVE-2020-35510

jboss-remoting: Threads hold up forever in the EJB server by suppressing the ack from an EJB client

A flaw was found in jboss-remoting in versions before 5.0.20.SP1-redhat-00001. A malicious attacker could cause threads to hold up forever in the EJB server by writing a sequence of bytes corresponding to the expected messages of a successful EJB client request, but omitting the ACK messages, or just tamper with jboss-remoting code, deleting the lines that send the ACK message from the EJB client code resulting in a denial of service. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 5.9 Medium EPSS 1.1% KEV · Not listed
Vendors
Redhat
Products
Jboss-remoting Jboss Enterprise Application Platform Jboss Fuse and 2 more
CVE-2020-27826

keycloak: Account REST API can update user metadata attributes

A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API. This flaw allows an attacker to change its own NameID attribute to impersonate the admin user for any particular application.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Keycloak Red Hat Single Sign On Single Sign-on
CVE-2020-27822

wildfly: Potential Memory leak in Wildfly when using OpenTracing

A flaw was found in Wildfly affecting versions 19.0.0.Final, 19.1.0.Final, 20.0.0.Final, 20.0.1.Final, and 21.0.0.Final. When an application uses the OpenTracing API's java-interceptors, there is a possibility of a memory leak. This flaw allows an attacker to impact the availability of the server. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 5.9 Medium EPSS 1.1% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Application Platform Jbosseapxp Openshift Application Runtimes and 2 more
CVE-2020-27782

undertow: special character in query results in server errors

A flaw was found in the Undertow AJP connector. Malicious requests and abrupt connection closes could be triggered by an attacker using query strings with non-RFC compliant characters resulting in a denial of service. The highest threat from this vulnerability is to system availability. This affects Undertow 2.1.5.SP1, 2.0.33.SP2, and 2.2.3.SP1.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed
Vendors
Redhat
Products
Camel Quarkus Integration Jboss Enterprise Application Platform and 5 more
CVE-2020-25689

wildfly-core: memory leak in WildFly host-controller in domain mode while not able to reconnect to domain-controller

A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating new connections which are not properly closed while not able to connect to domain-controller. This flaw allows an attacker to cause an Out of memory (OOM) issue, leading to a denial of service. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 5.3 Medium EPSS 1.5% KEV · Not listed
Vendors
Netapp Redhat
Products
Active Iq Unified Manager Oncommand Insight Service Level Manager and 8 more
CVE-2020-25633

resteasy-client: potential sensitive information leakage in JAX-RS RESTEasy Client's WebApplicationException handling

A flaw was found in RESTEasy client in all versions of RESTEasy up to 4.5.6.Final. It may allow client users to obtain the server's potentially sensitive information when the server got WebApplicationException from the RESTEasy client call. The highest threat from this vulnerability is to data confidentiality.

CVSS 3.1 · 5.3 Medium EPSS 1.2% KEV · Not listed
Vendors
Quarkus Redhat
Products
Quarkus Jboss Enterprise Application Platform Jboss Fuse and 4 more
CVE-2020-1758

keycloak: improper verification of certificate with host mismatch could result in information disclosure

A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server. This flaw allows an attacker to perform a man-in-the-middle (MITM) attack.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Single Sign On Keycloak Openstack and 1 more
CVE-2020-1744

keycloak: failedLogin Event not sent to BruteForceProtector when using Post Login Flow with Conditional-OTP

A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector does not handle this events.

CVSS 3.1 · 5.6 Medium EPSS 1.1% KEV · Not listed
Vendors
Redhat
Products
Jboss Single Sign On Keycloak Openshift Application Runtimes and 1 more
CVE-2020-1728

keycloak: security headers missing on REST endpoints

A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing general HTTP security headers in HTTP-responses. This does not directly lead to a security issue, yet it might aid attackers in their efforts to exploit other problems. The flaws unnecessarily make the servers more prone to Clickjacking, channel downgrade attacks and other similar client-based attack vectors.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Quarkus Redhat
Products
Quarkus Jboss Single Sign On Keycloak and 2 more
CVE-2020-1727

keycloak: missing input validation in IDP authorization URLs

A vulnerability was found in Keycloak before 9.0.2, where every Authorization URL that points to an IDP server lacks proper input validation as it allows a wide range of characters. This flaw allows a malicious to craft deep links that introduce further attack scenarios on affected clients.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Keycloak Openshift Application Runtimes Red Hat Single Sign On
CVE-2020-1724

keycloak: problem with privacy after user logout

A flaw was found in Keycloak in versions before 9.0.2. This flaw allows a malicious user that is currently logged in, to see the personal information of a previously logged out user in the account manager section.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Single Sign On Keycloak Openshift Application Runtimes and 2 more
CVE-2020-1698

keycloak: Password leak by logged exception in HttpMethod class

A flaw was found in keycloak in versions before 9.0.0. A logged exception in the HttpMethod class may leak the password given as parameter. The highest threat from this vulnerability is to data confidentiality.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Keycloak Openshift Application Runtimes Red Hat Single Sign On
CVE-2020-14389

keycloak: user can manage resources with just "view-profile" role using new Account Console

It was found that Keycloak before version 12.0.0 would permit a user with only view-profile role to manage the resources in the new account console, allowing access and modification of data the user was not intended to have.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Single Sign On Keycloak Red Hat Single Sign On
CVE-2020-14302

keycloak: reusable "state" parameter at redirect_uri endpoint enables possibility of replay attacks

A flaw was found in Keycloak before 13.0.0 where an external identity provider, after successful authentication, redirects to a Keycloak endpoint that accepts multiple invocations with the use of the same "state" parameter. This flaw allows a malicious user to perform replay attacks.

CVSS 3.1 · 4.9 Medium EPSS 1.0% KEV · Not listed
Vendors
Redhat
Products
Keycloak Red Hat Single Sign On
CVE-2020-13822

nodejs-elliptic: improper encoding checks allows a certain degree of signature malleability in ECDSA signatures

The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.

CVSS 3.1 · 7.7 High EPSS 2.7% KEV · Not listed
Vendors
Indutny Redhat
Products
Elliptic Openshift Red Hat Single Sign On
CVE-2020-10776

keycloak: OIDC redirect_uri allows dangerous schemes resulting in potential XSS

A flaw was found in Keycloak before version 12.0.0, where it is possible to add unsafe schemes for the redirect_uri parameter. This flaw allows an attacker to perform a Cross-site scripting attack.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Single Sign On Keycloak Red Hat Single Sign On