keycloak: XSS on impersonation under specific circumstances

A flaw was found in Keycloak. Under specific circumstances, HTML entities are not sanitized during user impersonation, resulting in a Cross-site scripting XSS vulnerability...

keycloak: XSS on impersonation under specific circumstances

A flaw was found in Keycloak. Under specific circumstances, HTML entities are not sanitized during user impersonation, resulting in a Cross-site scripting XSS vulnerability...

GHSA-9F95-HHG4-PG4F teler-waf subject to Bypass of Common Web Attack Threat Rule with HTML Entities Payload

Description teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. Versions prior to v0.1.1 are vulnerable to bypassing common web attack rules when a specific HTML entities payload is used. This vulnerability allows an attacker to execute...

teler-waf subject to Bypass of Common Web Attack Threat Rule with HTML Entities Payload

Description teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. Versions prior to v0.1.1 are vulnerable to bypassing common web attack rules when a specific HTML entities payload is used. This vulnerability allows an attacker to execute...

Keycloak vulnerable to Cross-site Scripting

A flaw was found in Keycloak. Under specific circumstances, HTML entities are not sanitized during user impersonation, resulting in a Cross-site scripting XSS vulnerability. Details This issue is the result of code found in the exception here:...

PT-2023-20448 · Teler-Waf · Teler-Waf

Name of the Vulnerable Software and Affected Versions: teler-waf versions prior to 0.1.1 Description: The issue exists due to teler-waf's failure to properly sanitize and filter HTML entities in user input, allowing an attacker to bypass common web attack rules and launch cross-site scripting XSS...

PT-2023-5051 · Red Hat · Keycloak

Name of the Vulnerable Software and Affected Versions: Keycloak affected versions not specified Description: A flaw was found in Keycloak, where under specific circumstances, HTML entities are not sanitized during user impersonation, resulting in a Cross-site scripting XSS vulnerability. This iss...

GHSA-Q8GG-VJ6M-HGMJ @braintree/sanitize-url Cross-site Scripting vulnerability

sanitize-url aka @braintree/sanitize-url before 6.0.1 allows XSS via HTML entities...

@braintree/sanitize-url Cross-site Scripting vulnerability

sanitize-url aka @braintree/sanitize-url before 6.0.1 allows XSS via HTML entities...

CVE-2022-48345

sanitize-url aka @braintree/sanitize-url before 6.0.2 allows XSS via HTML entities...

DEBIAN-CVE-2022-48345

sanitize-url aka @braintree/sanitize-url before 6.0.2 allows XSS via HTML entities...

Design/Logic Flaw

sanitize-url aka @braintree/sanitize-url before 6.0.2 allows XSS via HTML entities...

CVE-2022-48345

sanitize-url aka @braintree/sanitize-url before 6.0.2 allows XSS via HTML entities...

UBUNTU-CVE-2022-48345

sanitize-url aka @braintree/sanitize-url before 6.0.2 allows XSS via HTML entities...

CVE-2022-48345

sanitize-url aka @braintree/sanitize-url before 6.0.2 allows XSS via HTML entities...

CVE-2022-48345

sanitize-url aka @braintree/sanitize-url before 6.0.2 allows XSS via HTML entities...

CVE-2022-48345

CVE-2022-48345 affects sanitize-url (aka @braintree/sanitize-url) before 6.0.2, allowing XSS via HTML entities. Public references show fixes moving to 6.0.2+ (e.g., commit and release notes comparing 6.0.1 → 6.0.2). Remediation: upgrade to 6.0.2 or later.

CVE-2022-48345

sanitize-url aka @braintree/sanitize-url before 6.0.2 allows XSS via HTML entities...

Cross-site Scripting (XSS)

thorsten/phpmyfaq is vulnerable to Cross-site Scripting XSS. The vulnerability exists due to the missing conversion for HTML entities in Faq.php, allowing an attacker to inject and execute malicious JavaScript...

Cross-site Scripting (XSS)

thorsten/phpmyfaq is vulnerable to Cross-site Scripting XSS. The vulnerability exists due to the missing conversion for HTML entities in report.view.php, allowing an attacker to inject and execute malicious JavaScript through the FAQ-Proposal, which leads to an admin account takeover...