CVE-2021-41230 OIDC claims not updated from Identity Provider in Pomerium

Pomerium is an open source identity-aware access proxy. In affected versions changes to the OIDC claims of a user after initial login are not reflected in policy evaluation when using allowedidpclaims as part of policy. If using allowedidpclaims and a user's claims are changed, Pomerium can make...

Dell OpenManage Enterprise Information Disclosure Vulnerability

Dell OpenManage Enterprise is an easy-to-use, one-to-many system management console for IT infrastructure management from Dell, Inc. Dell OpenManage Enterprise 3.5 and OpenManage Enterprise-Modular 1.30.00 are vulnerable to information disclosure. An authenticated attacker could exploit the...

CVE-2021-21584

Dell OpenManage Enterprise version 3.5 and OpenManage Enterprise-Modular version 1.30.00 contain an information disclosure vulnerability. An authenticated low privileged attacker may potentially exploit this vulnerability leading to disclosure of the OIDC server credentials...

Information disclosure

Dell OpenManage Enterprise version 3.5 and OpenManage Enterprise-Modular version 1.30.00 contain an information disclosure vulnerability. An authenticated low privileged attacker may potentially exploit this vulnerability leading to disclosure of the OIDC server credentials...

CVE-2021-21584

Dell OpenManage Enterprise version 3.5 and OpenManage Enterprise-Modular version 1.30.00 contain an information disclosure vulnerability. An authenticated low privileged attacker may potentially exploit this vulnerability leading to disclosure of the OIDC server credentials...

PT-2021-6525 · Unknown +5 · Mod Auth Openidc +5

Name of the Vulnerable Software and Affected Versions: mod auth openidc versions prior to 2.4.9 Description: The issue is related to an XSS vulnerability in mod auth openidc when using OIDCPreservePost On. This vulnerability allows a remote attacker to impact the integrity of data. The estimated...

XML External Entity (XXE)

oauth2-oidc-sdk is vulnerable to XML external entity XXE attacks.The parse function in SAML2AssertionValidator.java does not disable access to external entities by default, allowing an attacker to submit a malicious XML document to perform requests on behalf of the server...

CVE-2020-10734

A vulnerability was found in keycloak in the way that the OIDC logout endpoint does not have CSRF protection. Versions shipped with Red Hat Fuse 7, Red Hat Single Sign-on 7, and Red Hat Openshift Application Runtimes are believed to be vulnerable...

Cross site request forgery (csrf)

A vulnerability was found in keycloak in the way that the OIDC logout endpoint does not have CSRF protection. Versions shipped with Red Hat Fuse 7, Red Hat Single Sign-on 7, and Red Hat Openshift Application Runtimes are believed to be vulnerable...

CVE-2020-10734

Keycloak is affected by CVE-2020-10734 due to missing CSRF protection on the OIDC logout endpoint. The vulnerability is described across multiple sources as affecting Keycloak implementations used with Red Hat Fuse 7, Red Hat SSO 7, and Red Hat OpenShift Application Runtimes, with the OIDC logout...

CVE-2020-10734

A vulnerability was found in keycloak in the way that the OIDC logout endpoint does not have CSRF protection. Versions shipped with Red Hat Fuse 7, Red Hat Single Sign-on 7, and Red Hat Openshift Application Runtimes are believed to be vulnerable...

CVE-2020-10734

A flaw was found in keycloak. The OIDC logout endpoint does not have CSRF protection. The highest threat from this vulnerability is to system availability...

Server-Side Request Forgery (SSRF)

keycloak is vulnerable to server-side request forgery SSRF. An attacker is submit requests on behalf of the server through the OIDC parameter requesturi...

CVE-2020-10770

A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter requesturi. This flaw allows an attacker to use this parameter to execute a Server-side request forgery SSRF attack...

CVE-2020-10770

A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter requesturi. This flaw allows an attacker to use this parameter to execute a Server-side request forgery SSRF attack...

CVE-2020-10770

CVE-2020-10770 describes a Server-Side Request Forgery (SSRF) in OpenID Connect Issuer handling of the request_uri parameter in Keycloak before 13.0.0, allowing an attacker to cause the server to fetch an unverified URL. The vulnerability is backed by multiple sources within the connected documen...

CVE-2020-10770

A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter requesturi. This flaw allows an attacker to use this parameter to execute a Server-side request forgery SSRF attack...

discourse-sso-oidc-bridge-consideratio (>=0.2.0 <=0.2.1), flask-pyoidc (>=3.1.0 <=3.6.0) +3 more potentially affected by CVE-2020-26244 via oic (>=0.8.2 <=1.1.2)

oic PYPI version =0.8.2, =0.2.0, =3.1.0, =0.0.9, =2.0.0, =0.6.1, =3.4.8 Source cves: CVE-2020-26244 Source advisory: OSV:GHSA-4FJV-PMHG-3RFG...

Red Hat Keycloak Server-Side Request Forgery Vulnerability

Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. A security vulnerability exists in Red Hat Keycloak. The vulnerability stems from the possibility of forcing the server to request a uri call t...

CVE-2020-10770

A flaw was found in Keycloak, where it is possible to force the server to call out an unverified URL using the OIDC parameter requesturi. This flaw allows an attacker to use this parameter to execute a Server-side request forgery SSRF attack...