Flask-CORS 安全漏洞

Flask-CORS is a cross-origin resource sharing component for Flask. A security vulnerability exists in Flask-CORS that stems from a vulnerability to a log injection attack when the log level is set to debug, which can be exploited by an attacker to send a specially crafted GET request that contain...

PT-2024-18217

Name of the Vulnerable Software and Affected Versions corydolphin/flask-cors affected versions not specified Description The issue is due to improper output neutralization for logs, allowing log injection when the log level is set to debug. An attacker can inject fake log entries into the log fil...

Improper Logs Output Neutralization

org.keycloak:keycloak-services is vulnerable to Improper Logs Output Neutralization . The vulnerability is due to errors in the browser client setup/auth process with "Security Key login" WebAuthn, which are written into the form, sent to Keycloak, and are logged without proper escaping, which...

GHSA-J628-Q885-8GR5 Keycloak vulnerable to log Injection during WebAuthn authentication or registration

A flaw was found in keycloak 22.0.5. Errors in browser client during setup/auth with "Security Key login" WebAuthn are written into the form, send to Keycloak and logged without escaping allowing log injection. Acknowledgements: Special thanks toTheresa Henze for reporting this issue and helping ...

Keycloak vulnerable to log Injection during WebAuthn authentication or registration

A flaw was found in keycloak 22.0.5. Errors in browser client during setup/auth with "Security Key login" WebAuthn are written into the form, send to Keycloak and logged without escaping allowing log injection. Acknowledgements: Special thanks toTheresa Henze for reporting this issue and helping ...

RHEL 9 : Red Hat Single Sign-On 7.6.8 security update on RHEL 9 (Important) (RHSA-2024:1862)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1862 advisory. Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single...

RHEL 7 : Red Hat Single Sign-On 7.6.8 and security update on RHEL 7 (Important) (RHSA-2024:1860)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1860 advisory. Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single...

Important: Red Hat Security Advisory: Red Hat Single Sign-On 7.6.8 security update

A security update is now available for Red Hat Single Sign-On 7.6 from the Customer Portal. This is an enhancement and security update with Important impact rating and package name 'rh-sso7-keycloak'. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, i...

keycloak: Log Injection during WebAuthn authentication or registration

A log injection flaw was found in Keycloak. A text string may be injected through the authentication form when using the WebAuthn authentication mode. This issue may have a minor impact to the logs integrity...

keycloak: Log Injection during WebAuthn authentication or registration

A log injection flaw was found in Keycloak. A text string may be injected through the authentication form when using the WebAuthn authentication mode. This issue may have a minor impact to the logs integrity...

Important: Red Hat Security Advisory: Red Hat Single Sign-On 7.6.8 security update on RHEL 9

New Red Hat Single Sign-On 7.6.8 deliverables are now available for Red Hat Enterprise Linux 9. This is an enhancement and security update with Important impact rating and package name 'rh-sso7-keycloak'. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity ratin...

Important: Red Hat Security Advisory: Red Hat Single Sign-On 7.6.8 security update on RHEL 8

New Red Hat Single Sign-On 7.6.8 deliverables are now available for Red Hat Enterprise Linux 8. This is an enhancement and security update with Important impact rating and package name 'rh-sso7-keycloak'. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity ratin...

keycloak: Log Injection during WebAuthn authentication or registration

A log injection flaw was found in Keycloak. A text string may be injected through the authentication form when using the WebAuthn authentication mode. This issue may have a minor impact to the logs integrity...

keycloak: Log Injection during WebAuthn authentication or registration

A log injection flaw was found in Keycloak. A text string may be injected through the authentication form when using the WebAuthn authentication mode. This issue may have a minor impact to the logs integrity...

Log Injection

ckan is vulnerable Log Injection. The vulnerability is due to the lack of filtering on incoming parameters in the user endpoint, allowing attackers to inject false log entries or corrupt the log file format, resulting in Log Injection...

CVE-2024-27097 Potential log injection in reset user endpoint in ckan

A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format. This has been fixed in the CKAN versions 2.9.11 and 2.10.4. Users are advised to upgrade...

CVE-2024-27097 Potential log injection in reset user endpoint in ckan

A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format. This has been fixed in the CKAN versions 2.9.11 and 2.10.4. Users are advised to upgrade...

Potential log injection in reset user endpoint in CKAN

A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format. Patches This has been fixed in the CKAN 2.9.11 and 2.10.4 versions Workarounds Override th...

GHSA-8G38-3M6V-232J Potential log injection in reset user endpoint in CKAN

A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format. Patches This has been fixed in the CKAN 2.9.11 and 2.10.4 versions Workarounds Override th...

PT-2024-21647

Name of the Vulnerable Software and Affected Versions CKAN versions prior to 2.9.11 CKAN versions prior to 2.10.4 Description A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log...