io.github.johnjcool:keycloak-cas-services (>=4.2.0.final, <=4.2.1.final), org.keycloak:keycloak-adapter-core (4.2.0.final) +64 more potentially affected by CVE-2020-14389 via org.keycloak:keycloak-core (4.2.0.final)

org.keycloak:keycloak-core MAVEN version 4.2.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.github.johnjcool:keycloak-cas-services =4.2.0.final, =4.2.1.final -...

io.github.johnjcool:keycloak-cas-services (>=4.3.0.final, <=4.3.1.final), org.keycloak:keycloak-adapter-core (4.3.0.final) +64 more potentially affected by CVE-2019-10170 via org.keycloak:keycloak-core (4.3.0.final)

org.keycloak:keycloak-core MAVEN version 4.3.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.github.johnjcool:keycloak-cas-services =4.3.0.final, =4.3.1.final -...

io.github.johnjcool:keycloak-cas-services (4.5.0.final), io.github.pablobastidasv:kc (1.3) +77 more potentially affected by CVE-2019-10170 via org.keycloak:keycloak-core (4.5.0.final)

org.keycloak:keycloak-core MAVEN version 4.5.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.github.johnjcool:keycloak-cas-services 4.5.0.final - io.github.pablobastidasv:kc 1.3 -...

Certify - Active Directory Certificate Abuse

Certify is a C tool to enumerate and abuse misconfigurations in Active Directory Certificate Services AD CS. @harmj0y and @tifkin are the primary authors of Certify and the the associated AD CS research blog and whitepaper. Usage C:\ToolsCertify.exe / | | | / | | | | | | | | | / \ '| | | | | | | ...

io.github.johnjcool:keycloak-cas-services (>=4.2.0.final, <=4.2.1.final), org.keycloak:keycloak-adapter-core (4.2.0.final) +64 more potentially affected by CVE-2020-1744 via org.keycloak:keycloak-core (4.2.0.final)

org.keycloak:keycloak-core MAVEN version 4.2.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.github.johnjcool:keycloak-cas-services =4.2.0.final, =4.2.1.final -...

com.antheminc.oss:nimbus-core (>=1.1.7, <=1.2.0), com.antheminc.oss:nimbus-entity-dsl (>=1.1.7, <=1.2.0) +130 more potentially affected by CVE-2021-35043 via org.owasp.antisamy:antisamy (>=1.5.7, <=1.6.3)

org.owasp.antisamy:antisamy MAVEN version =1.5.7, =1.1.7, =1.1.7, =1.1.7, =1.1.7, =1.1.7, =1.2.0, =1.2.0, =1.2.0, =1.0.5, =1.0.5, =1.0.5, =1.0.5, =1.5.14, =1.5.14, =1.5.26 and more Source cves: CVE-2021-35043 Source advisory: OSV:GHSA-9C8W-JRW3-Q2C3...

Improper Authentication in Apereo CAS

Apereo CAS 5.3.x before 5.3.16, 6.x before 6.1.7.2, 6.2.x before 6.2.4, and 6.3.x before 6.3.0-RC4 mishandles secret keys with Google Authenticator for multifactor authentication...

org.apereo.cas:cas-server-support-gauth (>=6.0.0, <=6.1.7.1), org.apereo.cas:cas-server-support-gauth-core (>=6.0.0, <=6.1.7.1) +8 more potentially affected by CVE-2020-27178 via org.apereo.cas:cas-server-support-otp-mfa-core (>=6.0.0, <=6.1.7.1)

org.apereo.cas:cas-server-support-otp-mfa-core MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.1.0-rc3, =6.0.0, =6.0.0, =6.1.0, =6.1.7.1 Source cves: CVE-2020-27178 Source advisory: GHSA-Q39C-5VH5-VW2P...

GHSA-Q39C-5VH5-VW2P Improper Authentication in Apereo CAS

Apereo CAS 5.3.x before 5.3.16, 6.x before 6.1.7.2, 6.2.x before 6.2.4, and 6.3.x before 6.3.0-RC4 mishandles secret keys with Google Authenticator for multifactor authentication...

org.apereo.cas:cas-server-support-gauth (>=6.2.0, <=6.2.3), org.apereo.cas:cas-server-support-gauth-core (>=6.2.0, <=6.2.3) +9 more potentially affected by CVE-2020-27178 via org.apereo.cas:cas-server-support-otp-mfa-core (>=6.2.0, <=6.2.3)

org.apereo.cas:cas-server-support-otp-mfa-core MAVEN version =6.2.0, =6.2.0, =6.2.0, =6.2.0, =6.2.0, =6.2.0, =6.2.0, =6.2.0, =6.2.0, =6.2.0, =6.2.0, =6.2.0, =6.2.3 Source cves: CVE-2020-27178 Source advisory: GHSA-Q39C-5VH5-VW2P...

CVE-2021-3636

OpenShift OpenShift before 4.8 includes an in-cluster Service CA certificate that incorrectly contains additional CA certificates. This allows an attacker who compromising any of those extra CAs to masquerade as a trusted in-cluster service, enabling potential impersonation of in-cluster services...

Jenkins CAS Plugin Input Validation Error Vulnerability

Jenkins is a Jenkins open source application . An open source automation server Jenkins provides hundreds of plug-ins to support building, deploying and automating any project . An input validation error vulnerability exists in Jenkins CAS Plugin 1.6.0 and earlier versions, which stems from Jenki...

CVE-2021-21673

Jenkins CAS Plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks...

CVE-2021-21673

Jenkins CAS Plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks...

CVE-2021-21673

Jenkins CAS Plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks...

Design/Logic Flaw

Jenkins CAS Plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks...

CVE-2021-21673

Jenkins CAS Plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks...

CVE-2021-21673

CVE-2021-21673 affects the Jenkins CAS Plugin up to version 1.6.0. The root cause is improper determination of a redirect URL after login, allowing phishing by redirecting users to an attacker-controlled site. Public disclosures (GHSA-2VVR-5757-QP87, OSV, NVD) note that Jenkins CAS Plugin 1.6.1 f...

CVE-2021-21673

Jenkins CAS Plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins, allowing attackers to perform phishing attacks...

Open redirect vulnerability in cas-plugin

cas-plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins. This allows attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site after successful authentication. cas-plugin 1.6....