Authorization Bypass

Keycloak is vulnerable to Authorization Bypass. The vulnerability is due to the token exchange feature ignoring tenant restrictions, where the restriction check is bypassed and an attacker with a valid Microsoft token from a different organization can gain access to the Keycloak realm...

Token Revocation Bypass

Keycloak is vulnerable to a token revocation bypass vulnerability. The vulnerability is due to an application-specific “not-before” token revocation policy being silently ignored when an older, non-zero realm-level policy exists, which allows an attacker to continue using previously issued tokens...

Improper Authorization

keycloak-services is vulnerable to an improper authorization. The vulnerability is due to insufficient permission checks when a restricted administrator lists users assigned to a role, which allows an attacker with limited administrative privileges to exploit the role-users endpoint and access...

Denial Of Service (DoS)

Netty is vulnerable to Denial Of Service. The vulnerability is due to XmlFrameDecoder.decode failing to preserve closing-tag parser state across invocations, allowing an unauthenticated remote attacker to trigger repeated buffer rescanning and exhaust an EventLoop thread's CPU...

Path Traversal

Logto is vulnerable to Path Traversal. The vulnerability is due to improper URL normalization and lack of path containment checks when constructing file paths from attacker-controlled requests, which allows an unauthenticated attacker to access and read files outside the configured static directo...

Missing Authorization

Keycloak is vulnerable to Missing Authorization. The vulnerability is due to improper filtering of token claims in signed JWT introspection responses for tokens issued to a different audience, which allows an unauthorized client to bypass audience restrictions and access sensitive token informati...

Sensitive Information Disclosure

Keycloak is vulnerable to Sensitive Information Disclosure. The vulnerability is due to improper authorization when retrieving rotated client secrets stored in a secure vault, which allows a delegated administrator with view-only permissions to obtain the actual secret instead of the vault...

Improper Authentication

Keycloak is vulnerable to Improper Authentication. The vulnerability is due to incorrect handling of SAML identity provider metadata that lacks key usage attributes, which allows an unauthenticated attacker to bypass SAML signature validation, forge a SAML response, and gain unauthorized access t...

Improper Authorization

Keycloak is vulnerable to Improper Authorization. The vulnerability is due to missing authorization checks in name-based admin REST API endpoints for composite role management, which allows a delegated administrator with manage-realm permissions to remove essential child roles from built-in admin...

Improper Authorization

Keycloak is vulnerable to Improper Authorization. The vulnerability is due to flawed group policy evaluation using a text-based prefix check for group membership, which allows a user belonging to a similarly named but unauthorized group to bypass access controls and gain unauthorized access to...

Memory Leak

Netty is vulnerable to a Memory Leak. The vulnerability is due to failure to release retained or newly allocated ByteBuf objects when IDN.toASCII or encodeDomainName reject a malformed domain name, where the exception occurs before the buffer is assigned to the DnsRecord content field, allowing...

Missing Authorization

Keycloak is vulnerable to Missing Authorization. The vulnerability is due to missing authorization checks when delegated administrators remove child roles from composite roles, which allows an attacker with limited administrative privileges to remove privileged roles they are not authorized to...

Authentication Bypass

Red Hat Build of Keycloak is vulnerable to an authentication bypass. The vulnerability is due to improper validation of cryptographic signatures when an OIDC identity provider is configured to skip signature validation, which allows an attacker with knowledge of specific session details to send a...

Authentication Policy Bypass

org.keycloak, keycloak-services is vulnerable to an authentication policy bypass. The vulnerability is due to improper evaluation of the client state during client updates, which allows an attacker with client management permissions to create a public client and subsequently update it to a...

Authorization Bypass

Keycloak is vulnerable to an authorization bypass. The vulnerability is due to improper validation of the fullScopeAllowed field when it is omitted from a client registration or configuration request, which allows a delegated attacker to bypass the policy, create a client with full-scope access,...

JEXL Expression Sandbox Bypass

org.opennms, opennms-util are vulnerable to a JEXL expression sandbox bypass. The vulnerability is due to insufficient sandbox restrictions when processing crafted JEXL expressions through the Measurements REST API, which allows a low-privileged authenticated attacker to escape the sandbox and lo...

Improper Authentication

Keycloak is vulnerable to Improper Authentication. The vulnerability is due to improper validation of client authentication assertions, which allows an attacker with valid client credentials to supply a fake unsigned assertion header and bypass policies requiring signed JWT authentication...

OAuth 2.0 Authorization Code Binding Bypass

org.keycloak, keycloak-services is vulnerable to an OAuth 2.0 authorization code binding bypass. The vulnerability is due to authorization codes not being properly bound to the client that originally requested them, which allows an attacker who intercepts an authorization code to modify and redee...

Security Restriction Bypass

org.keycloak, keycloak-services is vulnerable to a security restriction bypass. The vulnerability is due to insufficient host validation that checks only the beginning of a web address, which allows an attacker to bypass secure-client-uris policy restrictions using a specially crafted domain and...

Cross Site Scripting

DOMPurify is vulnerable to Cross-Site Scripting. The vulnerability is due to INPLACE sanitization, where element-removal hooks fail to neutralize detached subtrees and attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the...

Denial Of Service

Jackson Core is vulnerable to Denial Of Service. The vulnerability is due to NonBlockingUtf8JsonParserBase failing to enforce maxNumberLength when a non-blocking JSON number remains in MINORNUMBERINTEGERDIGITS across input chunks, allowing an attacker to exhaust JVM heap memory through repeated o...

Arbitrary Code Execution

JSONata is vulnerable to Arbitrary Code Execution. The vulnerability is due to the absence of an Object.prototype.hasOwnProperty check, which allows an attacker to access inherited prototype members and constructors and ultimately execute arbitrary code with the privileges of the host process...

Arbitrary Code Execution

JSONata is vulnerable to Arbitrary Code Execution. The vulnerability is due to object-integrity weaknesses that allow crafted JSONata expressions to manipulate internal functions and access prototype and constructor properties, which allows an attacker to execute arbitrary code with the privilege...

Improper Resource Shutdown

Apache HttpComponents Client is vulnerable to Improper Resource Shutdown. The vulnerability is due to the classic I/O model failing to release connections back to the connection manager when processing an invalid or unsupported Content-Encoding header value, potentially exhausting available...

Arbitrary Code Execution

JSONata is vulnerable to Arbitrary Code Execution. The vulnerability is due to a bypassable hasOwnProperty check that allows crafted expressions to access object prototypes and constructors, which allows an attacker to invoke process.getBuiltinModule with childprocess and execute arbitrary code...

Denial Of Service (DoS)

axios is vulnerable to Denial of Service DoS. The vulnerability is due to an incomplete depth-limit bypass in toFormData.js when processing object keys ending in , which allows an attacker controlling object keys and nested values to trigger excessive recursion and a RangeError, causing the...

Denial-Of-Service

com.rabbitmq, amqp-client is vulnerable to a Denial-of-service. the vulnerability is due to inconsistent application of the negotiated framemax limit, which allows a malicious or compromised RabbitMQ broker to send oversized method frames that the client attempts to allocate and decode instead of...

Denial Of Service (DoS)

sqlparse is vulnerable to Denial of Service DoS. The vulnerability is due to repeated rescanning of comment-only SQL statements before the grouping limit is enforced, which allows an attacker to provide crafted input that causes quadratic CPU consumption and degrades application performance...

Improper Certificate Validation

RabbitMQ Java client library is vulnerable to improper certificate validation. The vulnerability is due to ConnectionFactory.useSslProtocol accepting arbitrary server certificates and disabling hostname verification, which allows a network attacker to intercept TLS connections, impersonate the...

Denial-of-Service (DoS)

RabbitMQ Java client is vulnerable to a Denial-of-Service DoS. The vulnerability is due to CommandAssembler.consumeBodyFrame subtracting an attacker-controlled payload length before validating it, which allows a malicious or compromised RabbitMQ broker to send a malformed AMQP frame sequence...

Deserialization Of Untrusted Data

RabbitMQ Java client library is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to the javaReturnType value from an untrusted system.describe response being passed to Class.forName with class initialization enabled, which allows an attacker capable of intercepting or...

Files Or Directories Accessible To External Parties

Apache Flink Kubernetes Operator is vulnerable to Files or Directories Accessible to External Parties. The vulnerability is due to insufficient validation of the FlinkSessionJob jarURI, including missing scheme, host, and IP-range restrictions, which allows users with CR create permissions to rea...

Server-Side Request Forgery (SSRF)

magicmirror is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of attacker-controlled URLs and authentication parameters in the unauthenticated /calendar Socket.IO namespace, which allows an attacker to make arbitrary server-side requests, bypas...

Server-Side Request Forgery (SSRF)

SpringBlade is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of user-supplied URLs in the /ureport/datasource/testConnection endpoint, which allows an authenticated attacker to send crafted requests and scan internal or otherwise restricted...

Uncontrolled Resource Consumption

RabbitMQ Java client library is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to ValueReader.readBytes allocating a byte array based on a wire-declared content length before verifying the actual bytes available in the frame, which allows a malicious unauthenticated AMQ...

Uncontrolled Recursion

com.rabbitmq, amqp-client is vulnerable to Uncontrolled Recursion. The vulnerability is due to ValueReader.readTable and ValueReader.readArray recursively processing nested AMQP table and array values without a nesting-depth limit, which allows an attacker controlling the AMQP server or network...

Path Traversal

github.com/aquasecurity/trivy is vulnerable to a path traversal. The vulnerability is due to insufficient validation of plugin names when constructing paths under /.trivy/plugins, which allows an attacker who tricks a user into installing or running a malicious plugin to write the plugin manifest...

Stored Cross-Site Scripting (XSS)

Kestra is vulnerable to stored cross-site scripting XSS. The vulnerability is due to improper sanitization of JavaScript event-handler attributes in the custom link Markdown syntax, which allows an attacker with permission to create or update a Flow description to inject malicious JavaScript that...

Authorization Bypass

Copyparty is vulnerable to an authorization bypass. The vulnerability is due to improper handling of file and directory keys when the dk/dks directory-key flags are combined with the fk/fka file-key flags, which allows an attacker with a valid file key to convert it into a directory key and gain...

Uncontrolled Resource Consumption

deepmerge-ts is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to failure to track visited objects or object pairs during recursive merging, which allows an attacker to provide recursive object graphs that trigger infinite recursion, causing a RangeError and potentially...

Improper Authentication

Spring Cloud Config Server is vulnerable to Improper Authentication. The vulnerability is due to SessionManager persisting the first Vault token and ignoring subsequent X-CONFIG-TOKEN values, causing requests to use a previously stored token instead of the client-supplied token...

XML External Entity (XXE)

Ambari/Oozie is vulnerable to an XML External Entity XXE. The vulnerability is due to insecure XML parsing using DocumentBuilderFactory without disabling external entity resolution, which allows an attacker to inject malicious XML entities and exploit the application to read arbitrary files from...

Insecure Directory Permissions

org.springframework.data, spring-data-geode is vulnerable to Insecure Directory Permissions. The vulnerability is due to snapshot archives being extracted into predictable, permissive directories under the system temporary location, which allows a local attacker with basic privileges on a shared...

Integer Overflow

github.com/quantumnous/new-api is vulnerable to an integer overflow. The vulnerability is due to improper handling of user-controlled numeric values during quota and billing calculations, which allows a low-privileged attacker with a positive account balance or active subscription to cause intege...

Exposure Of Sensitive Authentication Credentials

New API is vulnerable to exposure of sensitive authentication credentials. The vulnerability is due to the admin user and user lookup APIs exposing User.AccessToken as accesstoken, which allows an authenticated administrator to obtain the root user's bearer token and use it to access root-only...

Authentication Bypass

Apache CXF is vulnerable to Authentication Bypass. The vulnerability is due to the JwtAccessTokenValidator failing to validate the aud Audience claim of JWT access tokens, which allows an attacker to replay a token issued for one resource server against a different resource server...

CRLF Injection

Apache CXF is vulnerable to CRLF Injection. The vulnerability is due to unsanitized clientId values from HTTP requests being directly included in OAuth2 server log messages, which allows an attacker to inject arbitrary content or forged log entries into server log files...

Improper Validation Of Specified Type Of Input

Apache CXF is vulnerable to Improper Validation of Specified Type of Input. The vulnerability is due to incomplete validation of untrusted JMS configuration, which allows an attacker who can configure JMS for Apache CXF to inject malicious configuration and potentially execute arbitrary code...

Race Condition

Apache CXF is vulnerable to a Race Condition. The vulnerability is due to improper synchronization when validating and consuming refresh tokens, which allows concurrent requests using the same leaked refresh token to bypass single-use restrictions and generate multiple valid access tokens...

Improper Authorization

Apache ActiveMQ is vulnerable to Improper Authorization. The vulnerability is due to incorrect default Jetty access controls that allow low-privileged authenticated Web Console users to access /admin/ paths, which allows them to perform administrative actions without the required privileges...