PT-2020-2664

Name of the Vulnerable Software and Affected Versions Keycloak versions prior to 9.0.1 Description A flaw was found in Keycloak when configuring a Conditional OTP Authentication Flow as a post login flow of an IDP. The failure login events for OTP are not being sent to the brute force protection...

keycloak: failedLogin Event not sent to BruteForceProtector when using Post Login Flow with Conditional-OTP

A flaw was found in keycloak. BruteForceProtector does not handle Conditional OTP Authentication Flow login failure events due to these events not being sent to the brute force protection event queue. The highest threat from this vulnerability is to data confidentiality and integrity as well as...

keycloak: failedLogin Event not sent to BruteForceProtector when using Post Login Flow with Conditional-OTP

A flaw was found in keycloak. BruteForceProtector does not handle Conditional OTP Authentication Flow login failure events due to these events not being sent to the brute force protection event queue. The highest threat from this vulnerability is to data confidentiality and integrity as well as...

keycloak: failedLogin Event not sent to BruteForceProtector when using Post Login Flow with Conditional-OTP

A flaw was found in keycloak. BruteForceProtector does not handle Conditional OTP Authentication Flow login failure events due to these events not being sent to the brute force protection event queue. The highest threat from this vulnerability is to data confidentiality and integrity as well as...

LY Corporation: Reflected XSS in OAUTH2 login flow

The reporter found a reflected XSS in the OAUTH2 login flow which could have allowed potential attackers to steal credentials or hijack accounts by sending a message to the victim containing a malicious URL...

CVE-2019-3803

Pivotal Concourse, all versions prior to 4.2.2, puts the user access token in a url during the login flow. A remote attacker who gains access to a user's browser history could obtain the access token and use it to authenticate as the user...

Improper access control

Pivotal Concourse, all versions prior to 4.2.2, puts the user access token in a url during the login flow. A remote attacker who gains access to a user's browser history could obtain the access token and use it to authenticate as the user...

CVE-2019-3803

Pivotal Concourse, all versions prior to 4.2.2, puts the user access token in a url during the login flow. A remote attacker who gains access to a user's browser history could obtain the access token and use it to authenticate as the user...

CVE-2018-15798

CVE-2018-15798 affects Pivotal Concourse (4.x) prior to 4.2.2. The login flow allows redirects to untrusted websites via the OAuth redirect, enabling an unauthenticated attacker to entice a user to click a link and obtain that user’s Concourse access token. Root cause is an open redirect in the l...

keycloak: brute force protection not working for the entire login workflow

A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. When TOPT enabled, an improper implementation of the Brute Force detection algorithm will not enforce its protection measures...

Alerton Webtalk 2.53.3 - Multiple Vulnerabilities

Alerton Webtalk 2.53.3 - Multiple Vulnerabilities ''' Security Issues in Alerton Webtalk ================================== Introduction ------------ Vulnerabilities were identified in the Alerton Webtalk Software supplied by Alerton. This software is used for the management of building automatio...