GHSA-8833-QRVM-WC3H OpenStack Keystone allows context-dependent attackers to bypass access restrictions

OpenStack Keystone Grizzly before 2013.1, Folsom 2012.1.3 and earlier, and Essex does not properly check if the 1 user, 2 tenant, or 3 domain is enabled when using EC2-style authentication, which allows context-dependent attackers to bypass access restrictions...

OpenStack Keystone allows context-dependent attackers to bypass access restrictions

OpenStack Keystone Grizzly before 2013.1, Folsom 2012.1.3 and earlier, and Essex does not properly check if the 1 user, 2 tenant, or 3 domain is enabled when using EC2-style authentication, which allows context-dependent attackers to bypass access restrictions...

GHSA-4PPJ-4P4V-JF4P OpenStack Keystone Denial of Service vulnerability via a large HTTP request

OpenStack Keystone Grizzly before 2013.1, Folsom, and possibly earlier allows remote attackers to cause a denial of service CPU and memory consumption via a large HTTP request, as demonstrated by a long tenantname when requesting a token...

OpenStack Keystone Denial of Service vulnerability via a large HTTP request

OpenStack Keystone Grizzly before 2013.1, Folsom, and possibly earlier allows remote attackers to cause a denial of service CPU and memory consumption via a large HTTP request, as demonstrated by a long tenantname when requesting a token...

GHSA-QH2X-HPF9-CF2G OpenStack Keystone and other components vulnerable to Improper Certificate Validation

HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates...

OpenStack Keystone and other components vulnerable to Improper Certificate Validation

HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates...

Cross-site Scripting (XSS)

@keystone-6/auth is vulnerable to cross-site scripting. The vulnerability exists in the pageMiddleware function in index.ts as it does not properly set pathname, allowing an attacker to gain sensitive information by redirecting to malicious websites...

GHSA-HRGX-7J6V-XJ82 Reflected cross-site scripting (XSS) vulnerability

This security advisory relates to a capability for an attacker to exploit a reflected cross-site scripting vulnerability when using the @keystone-6/auth package. Impact The vulnerability can impact users of the administration user interface when following an untrusted link to the signin or init...

Reflected cross-site scripting (XSS) vulnerability

This security advisory relates to a capability for an attacker to exploit a reflected cross-site scripting vulnerability when using the @keystone-6/auth package. Impact The vulnerability can impact users of the administration user interface when following an untrusted link to the signin or init...

CVE-2022-0087

keystone is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

CVE-2022-0087

keystone is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

Cross site scripting

keystone is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

keystone cross-site scripting vulnerability

Keystone is one of the most powerful Node.js headless Cms. used to help you build and scale faster than any other Cms or application framework. keystone suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data in web applications. An...

CVE-2022-0087

Keystone 6 login page vulnerability (CVE-2022-0087) involves an open redirect via the from= URL parameter, which can be escalated to reflected XSS. The issue is highlighted in the Nuclei template for Keystone 6 Login Page, describing an open redirect and potential XSS on the authentication flow. ...

Keystone 跨站脚本漏洞

Keystone is one of the most powerful Node.js headless Cms. used to help you build and scale faster than any other Cms or application framework. keystone suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data in web applications. An...

keystonenetworkingsystems.com Cross Site Scripting vulnerability OBB-2324459

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Information Disclosure

OpenStack Keystone allows information disclosure during account locking related to PCI DSS features. By guessing the name of an account and failing to authenticate multiple times, any unauthenticated actor could both confirm the account exists and obtain that account's corresponding UUID, which...

CVE-2021-38155

OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking related to PCI DSS features. By guessing the name of an account and failing to authenticate multiple times, any unauthenticated...

CVE-2021-38155

OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking related to PCI DSS features. By guessing the name of an account and failing to authenticate multiple times, any unauthenticated...

DEBIAN-CVE-2021-38155

OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking related to PCI DSS features. By guessing the name of an account and failing to authenticate multiple times, any unauthenticated...