4821 matches found
PT-2023-5052 · Red Hat · Keycloak
Name of the Vulnerable Software and Affected Versions: Keycloak affected versions not specified Description: A flaw was found in the "execute-actions-email" endpoint of Keycloak, allowing arbitrary HTML to be injected into emails sent to Keycloak users. This issue can be misused to perform phishi...
keycloak 授权问题漏洞
Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. A security vulnerability exists in keycloak. An attacker exploited the vulnerability to conduct user emulation via stolen uuid code...
Keycloak 跨站脚本漏洞
Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. A security vulnerability exists in Keycloak. An attacker could use this vulnerability to inject arbitrary HTML into a user's email and conduct...
Keycloak 安全漏洞
Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. Keycloak suffers from a security vulnerability that stems from an insecure configuration of the management interface. An attacker could use thi...
PT-2023-5051 · Red Hat · Keycloak
Name of the Vulnerable Software and Affected Versions: Keycloak affected versions not specified Description: A flaw was found in Keycloak, where under specific circumstances, HTML entities are not sanitized during user impersonation, resulting in a Cross-site scripting XSS vulnerability. This iss...
SUSE CVE-2020-1744
A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector does not handle this events...
SUSE CVE-2021-3461
A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type is set to Attribute Name...
SUSE CVE-2021-20323
A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak...
SUSE CVE-2022-1245
A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client application holding a valid access token to exchange tokens for any target client by passing the clientid of the target. This could allow a client to gain unauthorized access to...
@janus-idp/backstage-plugin-keycloak-backend (1.0.0) potentially affected by CVE-2023-25571 via @backstage/plugin-catalog-backend (1.5.1)
@backstage/plugin-catalog-backend NPM version 1.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on @backstage/plugin-catalog-backend and may be impacted: - @janus-idp/backstage-plugin-keycloak-backend 1.0.0 Source cves: CVE-2023-25571 Source advisory:...
CVE-2022-1970
CVE-2022-1970 entry is rejected/not used and does not represent an active vulnerability.
Vulnerability remedied in Keycloak
A vulnerability has been fixed in Keycloak. A malicious party can exploit the vulnerability to gain access via path-traversal to sensitive data. The vulnerability is caused by the fact that URL redirects where the client accepts wildcards are not correctly are processed correctly. -= Red Hat =- R...
Session fixation vulnerability in Jenkins Keycloak Authentication Plugin
Jenkins Keycloak Authentication Plugin 2.3.0 and earlier does not invalidate the previous session on login...
GHSA-9963-GMH8-VVM6 Session fixation vulnerability in Jenkins Keycloak Authentication Plugin
Jenkins Keycloak Authentication Plugin 2.3.0 and earlier does not invalidate the previous session on login...
GHSA-9WRR-4R9V-26XC CSRF vulnerability in Jenkins Keycloak Authentication Plugin
A cross-site request forgery CSRF vulnerability in Jenkins Keycloak Authentication Plugin 2.3.0 and earlier allows attackers to trick users into logging in to the attacker's account...
CSRF vulnerability in Jenkins Keycloak Authentication Plugin
A cross-site request forgery CSRF vulnerability in Jenkins Keycloak Authentication Plugin 2.3.0 and earlier allows attackers to trick users into logging in to the attacker's account...
CVE-2023-24457
A cross-site request forgery CSRF vulnerability in Jenkins Keycloak Authentication Plugin 2.3.0 and earlier allows attackers to trick users into logging in to the attacker's account...
CVE-2023-24457
A cross-site request forgery CSRF vulnerability in Jenkins Keycloak Authentication Plugin 2.3.0 and earlier allows attackers to trick users into logging in to the attacker's account...