Cross-site Scripting in Apereo CAS

Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints...

org.apereo.cas:cas-server-core (5.2.7), org.apereo.cas:cas-server-core-audit (5.2.7) +155 more potentially affected by CVE-2021-42567 via org.apereo.cas:cas-server-core-web (5.2.7)

org.apereo.cas:cas-server-core-web MAVEN version 5.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.apereo.cas:cas-server-core-web and may be impacted: - org.apereo.cas:cas-server-core 5.2.7 - org.apereo.cas:cas-server-core-audit 5.2.7 -...

Apereo CAS XSS vulnerability

Apereo CAS is a web-based enterprise multilingual single sign-on solution. versions prior to Apereo CAS 6.4.1 have a security vulnerability that can be exploited by attackers to send XSS via POST requests to REST API endpoints...

CVE-2021-42567

Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints...

CVE-2021-42567

Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints...

CVE-2021-42567

Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints...

Cross site scripting

Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints...

CVE-2021-42567

Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints...

CVE-2021-42567

Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints...

CVE-2021-42567

Summary (concrete details available) Apereo CAS several versions prior to 6.4.1 are vulnerable to a cross‑site scripting (XSS) flaw that can be triggered by POST requests to the REST API endpoints. The core issue is an XSS vulnerability in the REST API handling where user-supplied data is echoed ...

Apereo CAS cross-site scripting vulnerability

Apereo CAS is a web-based enterprise multilingual single sign-on solution. versions prior to Apereo CAS 6.4.1 have a security vulnerability that can be exploited by attackers to send XSS via POST requests to REST API endpoints...

PT-2021-23633

Name of the Vulnerable Software and Affected Versions Apereo CAS versions through 6.4.1 Description The issue allows for XSS via POST requests sent to the REST API endpoints. Recommendations For Apereo CAS versions through 6.4.1, consider restricting access to the REST API endpoints as a temporar...

CVE-2021-42567: Improper Neutralization of Input During Web Page Generation

Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints...

io.github.johnjcool:keycloak-cas-services (>=4.2.0.final, <=4.2.1.final), org.keycloak:keycloak-adapter-core (4.2.0.final) +64 more potentially affected by CVE-2020-14389 via org.keycloak:keycloak-core (4.2.0.final)

org.keycloak:keycloak-core MAVEN version 4.2.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.github.johnjcool:keycloak-cas-services =4.2.0.final, =4.2.1.final -...

io.github.johnjcool:keycloak-cas-services (>=4.3.0.final, <=4.3.1.final), org.keycloak:keycloak-adapter-core (4.3.0.final) +64 more potentially affected by CVE-2020-14389 via org.keycloak:keycloak-core (4.3.0.final)

org.keycloak:keycloak-core MAVEN version 4.3.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.github.johnjcool:keycloak-cas-services =4.3.0.final, =4.3.1.final -...

io.github.johnjcool:keycloak-cas-services (4.5.0.final), io.github.pablobastidasv:kc (1.3) +77 more potentially affected by CVE-2019-10170 via org.keycloak:keycloak-core (4.5.0.final)

org.keycloak:keycloak-core MAVEN version 4.5.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.github.johnjcool:keycloak-cas-services 4.5.0.final - io.github.pablobastidasv:kc 1.3 -...

io.github.johnjcool:keycloak-cas-services (>=4.3.0.final, <=4.3.1.final), org.keycloak:keycloak-adapter-core (4.3.0.final) +64 more potentially affected by CVE-2019-10170 via org.keycloak:keycloak-core (4.3.0.final)

org.keycloak:keycloak-core MAVEN version 4.3.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.github.johnjcool:keycloak-cas-services =4.3.0.final, =4.3.1.final -...

Certify - Active Directory Certificate Abuse

Certify is a C tool to enumerate and abuse misconfigurations in Active Directory Certificate Services AD CS. @harmj0y and @tifkin are the primary authors of Certify and the the associated AD CS research blog and whitepaper. Usage C:\ToolsCertify.exe / | | | / | | | | | | | | | / \ '| | | | | | | ...

io.github.johnjcool:keycloak-cas-services (>=4.2.0.final, <=4.2.1.final), org.keycloak:keycloak-adapter-core (4.2.0.final) +64 more potentially affected by CVE-2020-1744 via org.keycloak:keycloak-core (4.2.0.final)

org.keycloak:keycloak-core MAVEN version 4.2.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.github.johnjcool:keycloak-cas-services =4.2.0.final, =4.2.1.final -...

com.antheminc.oss:nimbus-core (>=1.1.7, <=1.2.0), com.antheminc.oss:nimbus-entity-dsl (>=1.1.7, <=1.2.0) +130 more potentially affected by CVE-2021-35043 via org.owasp.antisamy:antisamy (>=1.5.7, <=1.6.3)

org.owasp.antisamy:antisamy MAVEN version =1.5.7, =1.1.7, =1.1.7, =1.1.7, =1.1.7, =1.1.7, =1.2.0, =1.2.0, =1.2.0, =1.0.5, =1.0.5, =1.0.5, =1.0.5, =1.5.14, =1.5.14, =1.5.26 and more Source cves: CVE-2021-35043 Source advisory: OSV:GHSA-9C8W-JRW3-Q2C3...