4671 matches found
CVE-2025-58056 vulnerabilities
Vulnerabilities for packages: druid, apache-pulsar, apicurio-registry, strimzi-kafka-operator, selenium, tez, sonarqube, infinispan, kserve-modelmesh, celeborn, docker-selenium, trino, wildfly, akhq, flyway, thingsboard, keycloak, opensearch, zipkin, apache-activemq-artemis, wavefront-proxy,...
GHSA-FGHV-69VJ-QJ49 vulnerabilities
Vulnerabilities for packages: druid, apache-pulsar, apicurio-registry, strimzi-kafka-operator, selenium, tez, sonarqube, infinispan, kserve-modelmesh, celeborn, docker-selenium, trino, wildfly, akhq, flyway, thingsboard, keycloak, opensearch, zipkin, apache-activemq-artemis, wavefront-proxy,...
CVE-2025-58056 vulnerabilities
Vulnerabilities for packages: elasticsearch, apache-pulsar, apicurio-registry, selenium, logstash, wavefront-proxy, prometheus-jmx-exporter, elasticsearch-fips, spark, zipkin, kserve-modelmesh, management-api-for-apache-cassandra-4.0, grpc-java-fips, keycloak, opensearch, akhq, apache-hop-fips,...
GHSA-FGHV-69VJ-QJ49 vulnerabilities
Vulnerabilities for packages: elasticsearch, apache-pulsar, apicurio-registry, selenium, logstash, wavefront-proxy, prometheus-jmx-exporter, elasticsearch-fips, spark, zipkin, kserve-modelmesh, management-api-for-apache-cassandra-4.0, grpc-java-fips, keycloak, opensearch, akhq, apache-hop-fips,...
GHSA-XMCW-MV9P-7PQ2 Duplicate Advisory: Keycloak error_description injection on error pages that can trigger phishing attacks
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-27gc-wj6x-9w55. This link is maintained to preserve external references. Original Description A flaw was found in Keycloak. Keycloak’s account console and other pages accept arbitrary text in the errordescriptio...
Duplicate Advisory: Keycloak error_description injection on error pages that can trigger phishing attacks
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-27gc-wj6x-9w55. This link is maintained to preserve external references. Original Description A flaw was found in Keycloak. Keycloak’s account console and other pages accept arbitrary text in the errordescriptio...
CVE-2025-10043
Rejected reason: Considered by the maintainers a bug scenario experienced rather than a vulnerability...
CVE-2025-10044
A flaw was found in Keycloak. Keycloak’s account console and other pages accept arbitrary text in the errordescription query parameter. This text is directly rendered in error pages without validation or sanitization. While HTML encoding prevents XSS, an attacker can craft URLs with misleading...
CVE-2025-10043
CVE-2025-10043 is rejected/not used as stated; not an active vulnerability entry.
CVE-2025-10044 Keycloak: keycloak error_description injection on error pages
A flaw was found in Keycloak. Keycloak’s account console and other pages accept arbitrary text in the errordescription query parameter. This text is directly rendered in error pages without validation or sanitization. While HTML encoding prevents XSS, an attacker can craft URLs with misleading...
CVE-2025-10044 Keycloak: keycloak error_description injection on error pages
A flaw was found in Keycloak. Keycloak’s account console and other pages accept arbitrary text in the errordescription query parameter. This text is directly rendered in error pages without validation or sanitization. While HTML encoding prevents XSS, an attacker can craft URLs with misleading...
CVE-2025-10044
CVE-2025-10044 affects Keycloak: error_description injection on error pages allows arbitrary text to be rendered in the UI, enabling phishing-like messages (e.g., fake support numbers/URLs) without XSS. The issue is mitigated by HTML encoding but still enables deceptive content within the trusted...
CVE-2025-10044 Keycloak: keycloak error_description injection on error pages
A flaw was found in Keycloak. Keycloak’s account console and other pages accept arbitrary text in the errordescription query parameter. This text is directly rendered in error pages without validation or sanitization. While HTML encoding prevents XSS, an attacker can craft URLs with misleading...
CVE-2025-10044
A flaw was found in Keycloak. Keycloak’s account console and other pages accept arbitrary text in the errordescription query parameter. This text is directly rendered in error pages without validation or sanitization. While HTML encoding prevents XSS, an attacker can craft URLs with misleading...
Red Hat build of Keycloak 跨站脚本漏洞
Red Hat build of Keycloak is a web application for single sign-on from Red Hat, Inc. A cross-site scripting vulnerability exists in Red Hat Build of Keycloak that stems from incorrect handling of the errordescription parameter, which could lead to a phishing attack...
External Control of File Name or Path
Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to External Control of File Name or Path due to the vault secret lookup not accounting for the Windows file...
编号撤回
The Red Hat build of Keycloak is a web application for single sign-on from Red Hat USA. This CVE number has been withdrawn...
PT-2025-36326
Name of the Vulnerable Software and Affected Versions: Keycloak affected versions not specified Description: A path traversal flaw exists in Keycloak’s vault key handling on Windows. A previous fix for a related issue did not account for the Windows file separator , allowing a high-privilege...