OS Command Injection

React create-react-app is vulnerable to OS command injection. The vulnerability is due to improper handling of input in the startBrowserProcess function of openBrowser.js in react-dev-utils, which allows an attacker to manipulate the input and execute arbitrary operating system commands remotely...

Insecure Default Initialization Of Resource

org.openidentityplatform.openam, openam-core is vulnerable to Insecure Default Initialization of Resource. The vulnerability is due to the default configuration setting the iPlanetDirectoryPro SSO cookie with HttpOnly=false while also using the cookie as a CSRF token in OAuth/OIDC flows, which...

Information Disclosure

Keycloak is vulnerable to information disclosure. The vulnerability is due to insufficient authorization checks in the default-groups REST endpoint and realm representation, which allows a delegated administrator with realm-viewing permissions to access the names and identifiers of hidden default...

Improper Input Validation

Keycloak is vulnerable to Improper Input Validation. The vulnerability is due to the HTTP parameter pollution check ignoring the fragment portion of wildcard redirect URIs, allowing an attacker to inject duplicate security parameters that may cause improperly configured clients to trust...

Improper Hostname Validation

org.keycloak, keycloak-services is vulnerable to improper hostname validation. The vulnerability is due to improper validation of wildcard domain suffixes, which allows an attacker who controls the reverse DNS of their connection to bypass host-based restrictions and perform unauthorized client...

Privilege Escalation

Keycloak is vulnerable to Improper Authorization. The vulnerability is due to the Dynamic Client Registration policy failing to re-validate protocol mapper types during client updates, allowing an attacker with client registration privileges to replace an allowed mapper with a restricted...

Authentication Bypass

Keycloak is vulnerable to an authentication bypass. The vulnerability is due to missing brute-force protection validation in the CIBA token redemption handler, which allows an attacker with valid client credentials to obtain access and refresh tokens for a user whose account was locked after the...

Authorization Bypass

Keycloak is vulnerable to Authorization Bypass. The vulnerability is due to the token exchange feature ignoring tenant restrictions, where the restriction check is bypassed and an attacker with a valid Microsoft token from a different organization can gain access to the Keycloak realm...

Token Revocation Bypass

Keycloak is vulnerable to a token revocation bypass vulnerability. The vulnerability is due to an application-specific “not-before” token revocation policy being silently ignored when an older, non-zero realm-level policy exists, which allows an attacker to continue using previously issued tokens...

Improper Authorization

keycloak-services is vulnerable to an improper authorization. The vulnerability is due to insufficient permission checks when a restricted administrator lists users assigned to a role, which allows an attacker with limited administrative privileges to exploit the role-users endpoint and access...

Denial Of Service (DoS)

Netty is vulnerable to Denial Of Service. The vulnerability is due to XmlFrameDecoder.decode failing to preserve closing-tag parser state across invocations, allowing an unauthenticated remote attacker to trigger repeated buffer rescanning and exhaust an EventLoop thread's CPU...

Path Traversal

Logto is vulnerable to Path Traversal. The vulnerability is due to improper URL normalization and lack of path containment checks when constructing file paths from attacker-controlled requests, which allows an unauthenticated attacker to access and read files outside the configured static directo...

Missing Authorization

Keycloak is vulnerable to Missing Authorization. The vulnerability is due to improper filtering of token claims in signed JWT introspection responses for tokens issued to a different audience, which allows an unauthorized client to bypass audience restrictions and access sensitive token informati...

Sensitive Information Disclosure

Keycloak is vulnerable to Sensitive Information Disclosure. The vulnerability is due to improper authorization when retrieving rotated client secrets stored in a secure vault, which allows a delegated administrator with view-only permissions to obtain the actual secret instead of the vault...

Improper Authentication

Keycloak is vulnerable to Improper Authentication. The vulnerability is due to incorrect handling of SAML identity provider metadata that lacks key usage attributes, which allows an unauthenticated attacker to bypass SAML signature validation, forge a SAML response, and gain unauthorized access t...

Improper Authorization

Keycloak is vulnerable to Improper Authorization. The vulnerability is due to missing authorization checks in name-based admin REST API endpoints for composite role management, which allows a delegated administrator with manage-realm permissions to remove essential child roles from built-in admin...

Improper Authorization

Keycloak is vulnerable to Improper Authorization. The vulnerability is due to flawed group policy evaluation using a text-based prefix check for group membership, which allows a user belonging to a similarly named but unauthorized group to bypass access controls and gain unauthorized access to...

Memory Leak

Netty is vulnerable to a Memory Leak. The vulnerability is due to failure to release retained or newly allocated ByteBuf objects when IDN.toASCII or encodeDomainName reject a malformed domain name, where the exception occurs before the buffer is assigned to the DnsRecord content field, allowing...

Missing Authorization

Keycloak is vulnerable to Missing Authorization. The vulnerability is due to missing authorization checks when delegated administrators remove child roles from composite roles, which allows an attacker with limited administrative privileges to remove privileged roles they are not authorized to...

Authentication Bypass

Red Hat Build of Keycloak is vulnerable to an authentication bypass. The vulnerability is due to improper validation of cryptographic signatures when an OIDC identity provider is configured to skip signature validation, which allows an attacker with knowledge of specific session details to send a...

Authentication Policy Bypass

org.keycloak, keycloak-services is vulnerable to an authentication policy bypass. The vulnerability is due to improper evaluation of the client state during client updates, which allows an attacker with client management permissions to create a public client and subsequently update it to a...

Authorization Bypass

Keycloak is vulnerable to an authorization bypass. The vulnerability is due to improper validation of the fullScopeAllowed field when it is omitted from a client registration or configuration request, which allows a delegated attacker to bypass the policy, create a client with full-scope access,...

JEXL Expression Sandbox Bypass

org.opennms, opennms-util are vulnerable to a JEXL expression sandbox bypass. The vulnerability is due to insufficient sandbox restrictions when processing crafted JEXL expressions through the Measurements REST API, which allows a low-privileged authenticated attacker to escape the sandbox and lo...

Improper Authentication

Keycloak is vulnerable to Improper Authentication. The vulnerability is due to improper validation of client authentication assertions, which allows an attacker with valid client credentials to supply a fake unsigned assertion header and bypass policies requiring signed JWT authentication...

OAuth 2.0 Authorization Code Binding Bypass

org.keycloak, keycloak-services is vulnerable to an OAuth 2.0 authorization code binding bypass. The vulnerability is due to authorization codes not being properly bound to the client that originally requested them, which allows an attacker who intercepts an authorization code to modify and redee...

Security Restriction Bypass

org.keycloak, keycloak-services is vulnerable to a security restriction bypass. The vulnerability is due to insufficient host validation that checks only the beginning of a web address, which allows an attacker to bypass secure-client-uris policy restrictions using a specially crafted domain and...

Cross Site Scripting

DOMPurify is vulnerable to Cross-Site Scripting. The vulnerability is due to INPLACE sanitization, where element-removal hooks fail to neutralize detached subtrees and attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the...

Denial Of Service

Jackson Core is vulnerable to Denial Of Service. The vulnerability is due to NonBlockingUtf8JsonParserBase failing to enforce maxNumberLength when a non-blocking JSON number remains in MINORNUMBERINTEGERDIGITS across input chunks, allowing an attacker to exhaust JVM heap memory through repeated o...

Arbitrary Code Execution

JSONata is vulnerable to Arbitrary Code Execution. The vulnerability is due to the absence of an Object.prototype.hasOwnProperty check, which allows an attacker to access inherited prototype members and constructors and ultimately execute arbitrary code with the privileges of the host process...

Arbitrary Code Execution

JSONata is vulnerable to Arbitrary Code Execution. The vulnerability is due to object-integrity weaknesses that allow crafted JSONata expressions to manipulate internal functions and access prototype and constructor properties, which allows an attacker to execute arbitrary code with the privilege...

Improper Resource Shutdown

Apache HttpComponents Client is vulnerable to Improper Resource Shutdown. The vulnerability is due to the classic I/O model failing to release connections back to the connection manager when processing an invalid or unsupported Content-Encoding header value, potentially exhausting available...

Arbitrary Code Execution

JSONata is vulnerable to Arbitrary Code Execution. The vulnerability is due to a bypassable hasOwnProperty check that allows crafted expressions to access object prototypes and constructors, which allows an attacker to invoke process.getBuiltinModule with childprocess and execute arbitrary code...

Denial Of Service (DoS)

axios is vulnerable to Denial of Service DoS. The vulnerability is due to an incomplete depth-limit bypass in toFormData.js when processing object keys ending in , which allows an attacker controlling object keys and nested values to trigger excessive recursion and a RangeError, causing the...

Denial-Of-Service

com.rabbitmq, amqp-client is vulnerable to a Denial-of-service. the vulnerability is due to inconsistent application of the negotiated framemax limit, which allows a malicious or compromised RabbitMQ broker to send oversized method frames that the client attempts to allocate and decode instead of...

Denial Of Service (DoS)

sqlparse is vulnerable to Denial of Service DoS. The vulnerability is due to repeated rescanning of comment-only SQL statements before the grouping limit is enforced, which allows an attacker to provide crafted input that causes quadratic CPU consumption and degrades application performance...

Improper Certificate Validation

RabbitMQ Java client library is vulnerable to improper certificate validation. The vulnerability is due to ConnectionFactory.useSslProtocol accepting arbitrary server certificates and disabling hostname verification, which allows a network attacker to intercept TLS connections, impersonate the...

Denial-of-Service (DoS)

RabbitMQ Java client is vulnerable to a Denial-of-Service DoS. The vulnerability is due to CommandAssembler.consumeBodyFrame subtracting an attacker-controlled payload length before validating it, which allows a malicious or compromised RabbitMQ broker to send a malformed AMQP frame sequence...

Deserialization Of Untrusted Data

RabbitMQ Java client library is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to the javaReturnType value from an untrusted system.describe response being passed to Class.forName with class initialization enabled, which allows an attacker capable of intercepting or...

Files Or Directories Accessible To External Parties

Apache Flink Kubernetes Operator is vulnerable to Files or Directories Accessible to External Parties. The vulnerability is due to insufficient validation of the FlinkSessionJob jarURI, including missing scheme, host, and IP-range restrictions, which allows users with CR create permissions to rea...

Server-Side Request Forgery (SSRF)

magicmirror is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of attacker-controlled URLs and authentication parameters in the unauthenticated /calendar Socket.IO namespace, which allows an attacker to make arbitrary server-side requests, bypas...

Server-Side Request Forgery (SSRF)

SpringBlade is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of user-supplied URLs in the /ureport/datasource/testConnection endpoint, which allows an authenticated attacker to send crafted requests and scan internal or otherwise restricted...

Uncontrolled Resource Consumption

RabbitMQ Java client library is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to ValueReader.readBytes allocating a byte array based on a wire-declared content length before verifying the actual bytes available in the frame, which allows a malicious unauthenticated AMQ...

Uncontrolled Recursion

com.rabbitmq, amqp-client is vulnerable to Uncontrolled Recursion. The vulnerability is due to ValueReader.readTable and ValueReader.readArray recursively processing nested AMQP table and array values without a nesting-depth limit, which allows an attacker controlling the AMQP server or network...

Path Traversal

github.com/aquasecurity/trivy is vulnerable to a path traversal. The vulnerability is due to insufficient validation of plugin names when constructing paths under /.trivy/plugins, which allows an attacker who tricks a user into installing or running a malicious plugin to write the plugin manifest...

Stored Cross-Site Scripting (XSS)

Kestra is vulnerable to stored cross-site scripting XSS. The vulnerability is due to improper sanitization of JavaScript event-handler attributes in the custom link Markdown syntax, which allows an attacker with permission to create or update a Flow description to inject malicious JavaScript that...

Authorization Bypass

Copyparty is vulnerable to an authorization bypass. The vulnerability is due to improper handling of file and directory keys when the dk/dks directory-key flags are combined with the fk/fka file-key flags, which allows an attacker with a valid file key to convert it into a directory key and gain...

Uncontrolled Resource Consumption

deepmerge-ts is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to failure to track visited objects or object pairs during recursive merging, which allows an attacker to provide recursive object graphs that trigger infinite recursion, causing a RangeError and potentially...

Improper Authentication

Spring Cloud Config Server is vulnerable to Improper Authentication. The vulnerability is due to SessionManager persisting the first Vault token and ignoring subsequent X-CONFIG-TOKEN values, causing requests to use a previously stored token instead of the client-supplied token...

XML External Entity (XXE)

Ambari/Oozie is vulnerable to an XML External Entity XXE. The vulnerability is due to insecure XML parsing using DocumentBuilderFactory without disabling external entity resolution, which allows an attacker to inject malicious XML entities and exploit the application to read arbitrary files from...

Insecure Directory Permissions

org.springframework.data, spring-data-geode is vulnerable to Insecure Directory Permissions. The vulnerability is due to snapshot archives being extracted into predictable, permissive directories under the system temporary location, which allows a local attacker with basic privileges on a shared...