5116213 matches found
CVE-2022-24086
CVE-2022-24086 CVE-2022-24086 POC example provided by BurpRoot CVE-2022-24086: Overview Affected Software: Magento2 CVE ID: CVE-2022-24086 CVSS Score: 9.8 Critical Description CVE-2022-24086 is a critical security vulnerability affecting multiple versions of the Magento2 e-commerce platform. This...
redis-stack-CVE-2024-55656
CVE-2024-55656 - Redis Stack - RedisBloom Integer Overflow Remote Code Execution Vulnerability Title: Redis Stack RedisBloom Integer Overflow Remote Code Execution Vulnerability ZDI: ZDI-25-009 CVE: CVE-2024-55656 Credits: rick2600 and gqsilva CVSS: 8.8 HIGH Affected version: RedisBloom v2.6.12...
CVE-2020-3452
CVE-2020-3452 CVSS 7.5 base wget https://bit.ly/32Q065t wget https://vpn.target.local:443/+CSCOT+/translation-table?type=mst&textdomain=/%2bCSCOE%2b/portalinc.lua&default-language&lang=../ wget...
CVE-2026-48908-by-yora
🔐 CVE-2026-48908 Scanner & Safe PoC Joomla SP Page Builder — Unauthenticated File Upload / Potential RCE Developed byyora 📌 About This project is a security research and vulnerability detection tool developed by yora to help identify CVE-2026-48908 affecting SP Page Builder for Joomla. The...
EUVD-2026-83602
A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administrator, who should be restricted from...
CVE-2026-94001
A flaw in the Admin REST API of Keycloak (an open-source identity and access management solution) allows a delegated administrator to bypass fine-grained reset-password permissions. The endpoint used for deleting user credentials fails to properly check these permissions, enabling an administrato...
CVE-2026-94001 Keycloak-services: keycloak-services: admin credential delete bypasses denied reset-password permission
A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administrator, who should be restricted from...
CVE-2024-10511
CVE-2024-10511 CWE-287: Improper Authentication Summary Schneider Electric PowerChute Serial Shutdown product is a UPS management software enabling graceful system shutdown and energy management capabilities for desktop, servers and workstations PowerChute Serial Shutdown v1.2.0.301 and prior...
EUVD-2026-83601
A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the system fails to check if a group grants administrative privileges before allowing a user to be added. This allows a delegated...
CVE-2026-94000 Keycloak-services: keycloak-services: delegated admin with manage-users can escalate to realm-admin via group membership
A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the system fails to check if a group grants administrative privileges before allowing a user to be added. This allows a delegated...
CVE-2026-94000
A flaw in the Admin REST API of Keycloak (open-source identity and access management) exists in the group-membership endpoints . The system fails to check whether a group grants administrative privileges before allowing a user to be added to it. This allows a delegated administrator holding the m...
CVE-2026-94000 Keycloak-services: keycloak-services: delegated admin with manage-users can escalate to realm-admin via group membership
A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the system fails to check if a group grants administrative privileges before allowing a user to be added. This allows a delegated...
CVE-2026-94001
A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administrator, who should be restricted from...
CVE-2026-93999 Keycloak-services: keycloak-services: token refresh continues issuing tokens for disabled audience clients
A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh process when the server restores requested audiences from stored client IDs. Keycloak fails to verify if the target audience client i...
CVE-2026-93999
Keycloak's OIDC token refresh process contains a flaw where the server restores requested audiences from stored client IDs but fails to verify whether the target audience client is still enabled before issuing a new access token. This allows an application holding an existing refresh token to con...
EUVD-2026-83600
A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh process when the server restores requested audiences from stored client IDs. Keycloak fails to verify if the target audience client i...
CVE-2026-94000
A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the system fails to check if a group grants administrative privileges before allowing a user to be added. This allows a delegated...
4062-1
Black Duck CoPilot Gradle/Travis CI Example Shows a working setup for using the Black Duck CoPilot integration to analyze the risk of project dependencies Travis CI Setup The .travis.yml file has been modified to upload generated dependency data to Black Duck CoPilot: root@kitploit: aftersuccess:...
