CVE-2024-42163

Insufficiently random values for generating password reset token in FIWARE Keyrock = 8.4 allow attackers to take over the account of any user by predicting the token for the password reset link...

CVE-2024-42167 Command Injection in Organisationname

The function "generateappcertificates" in controllers/saml2/saml2.js of FIWARE Keyrock = 8.4 does not neutralize special elements used in an OS Command properly. This allows an authenticated user with permissions to create applications to execute commands by creating an application with a malicio...

CVE-2024-42167 Command Injection in Organisationname

The function "generateappcertificates" in controllers/saml2/saml2.js of FIWARE Keyrock = 8.4 does not neutralize special elements used in an OS Command properly. This allows an authenticated user with permissions to create applications to execute commands by creating an application with a malicio...

CVE-2024-42167

The CVE-2024-42167 entry concerns FIWARE Keyrock (

CVE-2024-42166 Command Injection in Applicationname

The function "generateappcertificates" in lib/appcertificates.js of FIWARE Keyrock = 8.4 does not neutralize special elements used in an OS Command properly. This allows an authenticated user with permissions to create applications to execute commands by creating an application with a malicious...

CVE-2024-42166

The CVE-2024-42166 entry concerns FIWARE Keyrock 8.4 and earlier, where generate_app_certificates in lib/app_certificates.js fails to neutralize OS command elements. This enables an authenticated user with permissions to create applications to execute arbitrary commands by supplying a malicious a...

CVE-2024-42166 Command Injection in Applicationname

The function "generateappcertificates" in lib/appcertificates.js of FIWARE Keyrock = 8.4 does not neutralize special elements used in an OS Command properly. This allows an authenticated user with permissions to create applications to execute commands by creating an application with a malicious...

CVE-2024-42165 Arbitrary User Activation

Insufficiently random values for generating activation token in FIWARE Keyrock = 8.4 allow attackers to activate accounts of any user by predicting the token for the activation link...

CVE-2024-42165 Arbitrary User Activation

Insufficiently random values for generating activation token in FIWARE Keyrock = 8.4 allow attackers to activate accounts of any user by predicting the token for the activation link...

CVE-2024-42165

FIWARE Keyrock crypto issue: activation tokens are generated from insufficiently random values in Keyrock ≤ 8.4, enabling an attacker to predict activation tokens and activate arbitrary user accounts. Several connected sources (Red Hat, CNVD/CNNVD mirrors, OSV, CVE records) corroborate the vulner...

CVE-2024-42164 Disabling MFA without Authentication

Insufficiently random values for generating password reset token in FIWARE Keyrock = 8.4 allow attackers to disable two factor authorization of any user by predicting the token for the disable2fa link...

CVE-2024-42164 Disabling MFA without Authentication

Insufficiently random values for generating password reset token in FIWARE Keyrock = 8.4 allow attackers to disable two factor authorization of any user by predicting the token for the disable2fa link...

CVE-2024-42163 Password Manipulation

Insufficiently random values for generating password reset token in FIWARE Keyrock = 8.4 allow attackers to take over the account of any user by predicting the token for the password reset link...

CVE-2024-42163

CVE-2024-42163 affects FIWARE Keyrock up to version 8.4. The root cause is insufficiently random values used to generate password reset tokens, enabling an attacker to predict a token and seize a user’s account. Affected component: Keyrock password reset flow; vulnerable until patch/version that ...

CVE-2024-42163 Password Manipulation

Insufficiently random values for generating password reset token in FIWARE Keyrock = 8.4 allow attackers to take over the account of any user by predicting the token for the password reset link...

FIWARE Keyrock 安全漏洞

FIWARE Keyrock is a FIWARE open source component responsible for identity management. A cryptographic vulnerability exists in FIWARE Keyrock 8.4 and earlier versions, which stems from the algorithm used to create the disable2fakey being predictable, and can be exploited by an attacker to predict...

FIWARE Keyrock 安全漏洞

FIWARE Keyrock is a FIWARE open source component responsible for identity management. A cryptographic vulnerability exists in FIWARE Keyrock 8.4 and earlier versions, which stems from the predictability of the algorithm used to create password reset tokens, and can be exploited by an attacker to...

PT-2024-29781 · Fiware · Fiware Keyrock

Name of the Vulnerable Software and Affected Versions: FIWARE Keyrock versions = 8.4 Description: The issue is related to insufficiently random values used for generating password reset tokens, allowing attackers to predict the token and disable two-factor authorization for any user. This makes i...

FIWARE Keyrock 安全漏洞

FIWARE Keyrock is a FIWARE open source component responsible for identity management. A cryptographic vulnerability exists in FIWARE Keyrock 8.4 and prior versions, which arises from a predictable random value for user-created activation tokens that can be exploited by an attacker to predict...

FIWARE Keyrock 安全漏洞

FIWARE Keyrock is a FIWARE open source component responsible for identity management. An operating system command injection vulnerability exists in FIWARE Keyrock 8.4 and earlier versions, which stems from the function generateappcertificates in lib/appcertificates.js not being properly...