GHSA-W8V7-C7PM-7WFR Duplicate Advisory: Keycloak vulnerable to Cross-Site Scripting (XSS)

Duplicate Advisory This advisory is a duplicate of GHSA-w9mf-83w3-fv49. This link is maintained to preserve external references. Original Description A stored Cross-site scripting XSS vulnerability was found in keycloak as shipped in Red Hat Single Sign-On 7. This flaw allows a privileged attacke...

NodeBB Forum Software 跨站请求伪造漏洞

NodeBB is a forum system from the Design Create Play team built using Node.js, a web application platform built on top of Google's V8 JavaScript engine. A cross-site request forgery vulnerability exists in NodeBB Forum Software versions prior to 1.17.1, which stems from an unwanted condition in t...

PT-2022-23164 · Nodebb · Nodebb Forum

Name of the Vulnerable Software and Affected Versions: NodeBB Forum Software versions prior to 1.17.2 Description: The issue is caused by an unnecessarily strict conditional in the code handling the first step of the Single Sign-On SSO process. This conditional inadvertently rendered the...

The vulnerability of the IAM and SSO Casdoor platform lies in its ability to download files of a malicious nature without limitation. This allows a hacker to download and execute any file on the target system.

The vulnerability of the IAM and SSO Casdoor platform lies in its ability to allow unlimited loading of malicious files. Exploiting this vulnerability could enable a malicious actor, operating remotely, to load and execute any file on the target system...

CVE-2022-2256

A Stored Cross-site scripting XSS vulnerability was found in keycloak as shipped in Red Hat Single Sign-On 7. This flaw allows a privileged attacker to execute malicious scripts in the admin console, abusing the default roles functionality...

Cross site scripting

A Stored Cross-site scripting XSS vulnerability was found in keycloak as shipped in Red Hat Single Sign-On 7. This flaw allows a privileged attacker to execute malicious scripts in the admin console, abusing the default roles functionality...

CVE-2022-2256

CVE-2022-2256 is a stored XSS vulnerability in Keycloak as shipped with Red Hat Single Sign-On (RH SSO) 7.x. The issue stems from improper validation of user-supplied input in the admin console, enabling a privileged attacker to inject and execute scripts via the admin UI by abusing the default r...

CVE-2022-2256

A Stored Cross-site scripting XSS vulnerability was found in keycloak as shipped in Red Hat Single Sign-On 7. This flaw allows a privileged attacker to execute malicious scripts in the admin console, abusing the default roles functionality...

CVE-2022-2256

A Stored Cross-site scripting XSS vulnerability was found in keycloak as shipped in Red Hat Single Sign-On 7. This flaw allows a privileged attacker to execute malicious scripts in the admin console, abusing the default roles functionality...

CVE-2022-2256: Improper Neutralization of Input During Web Page Generation

A Stored Cross-site scripting XSS vulnerability was found in keycloak as shipped in Red Hat Single Sign-On 7. This flaw allows a privileged attacker to execute malicious scripts in the admin console, abusing the default roles functionality...

PT-2022-15528 · Red Hat · Keycloak +1

Name of the Vulnerable Software and Affected Versions: Red Hat Single Sign-On 7 Keycloak versions prior to 18.0.1 Description: A Stored Cross-site scripting XSS vulnerability was found in Keycloak as shipped in Red Hat Single Sign-On 7. This flaw allows a privileged attacker to execute malicious...

CVE-2022-34858

Authentication Bypass vulnerability in miniOrange OAuth 2.0 client for SSO plugin = 1.11.3 at WordPress...

WordPress plugin OAuth 访问控制错误漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An access control error vulnerability...

Simple Single Sign On <= 4.1.0 - Authentication Bypass

The plugin leaks its OAuth clientsecret, which could be used by attackers to gain unauthorized access to the site. When we click the "Single Sign On" button, the plugin redirects us to the OAuth server to authenticate ourselves if we are not logged in. The button invokes the following URL:...

Simple Single Sign On <= 4.1.0 - Authentication Bypass

The plugin leaks its OAuth clientsecret, which could be used by attackers to gain unauthorized access to the site. PoC When we click the "Single Sign On" button, the plugin redirects us to the OAuth server to authenticate ourselves if we are not logged in. The button invokes the following URL:...

WordPress Simple Single Sign On plugin <= 4.1.0 - Authentication Bypass vulnerability

Authentication Bypass vulnerability discovered by Lana Codes in WordPress Simple Single Sign On plugin versions = 4.1.0. Solution Deactivate and delete. This plugin has been closed as of June 9, 2022 and is not available for download. Reason: Security Issue...

LDAP Injection Authentication Bypass

Lightweight Directory Access Protocol LDAP is used by web applications to access and maintain directory information services. One of the most common uses for LDAP is to provide a Single-Sign-On SSO service that will allow clients to authenticate with a web site without any interaction assuming...

CVE-2022-27620

Improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability in webapi component in Synology SSO Server before 2.2.3-0331 allows remote authenticated users to read arbitrary files via unspecified vectors...

Security Bulletin: Vulnerability in WebSphere Application Server shipped with IBM Security Access Manager for Enterprise Single Sign-On (CVE-2022-22477)

Summary IBM WebSphere Application Server is shipped with IBM Security Access Manager for Enterprise Single Sign-On. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletin...

PT-2022-7864 · Zulip · Zulip

Name of the Vulnerable Software and Affected Versions: Zulip versions prior to 1.3.12 Description: The issue allows deactivated users to access messages when Single Sign-On SSO is enabled. Recommendations: For versions prior to 1.3.12, update to version 1.3.12 or later to resolve the issue...