keycloak: Default Client configuration is vulnerable to SSRF using "request_uri" parameter

A flaw was found in Keycloak, where it is possible to force the server to call out an unverified URL using the OIDC parameter requesturi. This flaw allows an attacker to use this parameter to execute a Server-side request forgery SSRF attack...

CVE-2020-10770

A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter requesturi. This flaw allows an attacker to use this parameter to execute a Server-side request forgery SSRF attack...

CVE-2020-10770: Server-Side Request Forgery (SSRF)

A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter requesturi. This flaw allows an attacker to use this parameter to execute a Server-side request forgery SSRF attack...

CVE-2020-10770

A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter requesturi. This flaw allows an attacker to use this parameter to execute a Server-side request forgery SSRF attack...

CVE-2020-10770

A flaw was found in Keycloak, where it is possible to force the server to call out an unverified URL using the OIDC parameter requesturi. This flaw allows an attacker to use this parameter to execute a Server-side request forgery SSRF attack...

CVE-2011-5018

Koala Framework before 2011-11-21 has XSS via the requesturi parameter...

Design/Logic Flaw

Koala Framework before 2011-11-21 has XSS via the requesturi parameter...

CVE-2011-5018

Koala Framework before 2011-11-21 has XSS via the requesturi parameter...

CVE-2011-5018

Koala Framework before 2011-11-21 has XSS via the requesturi parameter...

CVE-2011-5018

Koala Framework is affected by a Cross-Site Scripting (XSS) vulnerability via the request_uri parameter in versions prior to 2011-11-21. The root cause, as described across multiple sources, is insufficient validation/ sanitization of client-side data. Impact is described as XSS, with no explicit...

CVE-2011-5018: Improper Neutralization of Input During Web Page Generation

Koala Framework before 2011-11-21 has XSS via the requesturi parameter...

CVE-2018-17039

MiniCMS 1.10, when Internet Explorer is used, allows XSS via a crafted URI because $SERVER'REQUESTURI' is mishandled...

CVE-2018-17039: Improper Neutralization of Input During Web Page Generation

MiniCMS 1.10, when Internet Explorer is used, allows XSS via a crafted URI because $SERVER'REQUESTURI' is mishandled...

CVE-2018-10183: Improper Neutralization of Input During Web Page Generation

An issue was discovered in BigTree 4.2.22. There is cross-site scripting XSS in /core/inc/lib/less.php/test/index.php because of a $SERVER'REQUESTURI' echo, as demonstrated by the dir parameter in a file=charsets action...

Cross-Site Scripting (XSS)

silverstripe/framework is vulnerable to cross-site scripting XSS attacks. These attacks are possible because the REQUESTURI parameter is not sanitized properly, allowing the attackers to insert arbitrary Javascript which gets executed by the browser...

Information Disclosure And Open Redirect

drupal/core is vulnerable to information disclosure and open redirect attacks. The attacks exist due to a flaw in requesturi code in FormBuilder.php, allowing a malicious user to redirect a user or sensitive data to a malicious website...

Automattic: woocommerce - prevent_caching() bug / bypass

As guest visit the following links and look at the headers. Yup there are not caching headers in the response. https://woocommerce.com/.cart/https://woocommerce.com/.cart/ https://woocommerce.com/+cart/https://woocommerce.com/+cart/ https://woocommerce.com/-cart/https://woocommerce.com/-cart/...

CVE-2016-5114

sapi/fpm/fpm/fpmlog.c in PHP before 5.5.31, 5.6.x before 5.6.17, and 7.x before 7.0.2 misinterprets the semantics of the snprintf return value, which allows attackers to obtain sensitive information from process memory or cause a denial of service out-of-bounds read and buffer overflow via a long...

CVE-2016-5114: Improper Restriction of Operations within the Bounds of a Memory Buffer

sapi/fpm/fpm/fpmlog.c in PHP before 5.5.31, 5.6.x before 5.6.17, and 7.x before 7.0.2 misinterprets the semantics of the snprintf return value, which allows attackers to obtain sensitive information from process memory or cause a denial of service out-of-bounds read and buffer overflow via a long...

WordPress 2.2 Request_URI Parameter Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/24383/info WordPress is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the...