Identityserver

Records3All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

Identityserver records in CISA KEV

No Identityserver vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Identityserver4 2 records LOW Identityserver3 1 record LOW

Records

3 records

TI-2018-06438 CVE-2018-8899 · GHSA-mvpr-3vvr-7vqx

IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the…

LOW 30

IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the redirect URI on the authorization response page, which might lead to XSS in some configurations.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01215 Published 2018-03-22 No fix listed CWE-79

TI-2019-09138 CVE-2019-12250 · GHSA-jg67-mr48-c26q

IdentityServer IdentityServer4 through 2.4 has stored XSS via the httpContext to the…

LOW 29

IdentityServer IdentityServer4 through 2.4 has stored XSS via the httpContext to the host/Extensions/RequestLoggerMiddleware.cs LogForErrorContext method, which can be triggered by viewing a log.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00848 Published 2019-05-21 No fix listed CWE-79

TI-2017-09396 CVE-2017-12677 · GHSA-gf3v-79w2-h666

IdentityServer3 2.4.x, 2.5.x, and 2.6.x before 2.6.1 has XSS in an Angular expression on…

LOW 29

IdentityServer3 2.4.x, 2.5.x, and 2.6.x before 2.6.1 has XSS in an Angular expression on the authorize response page, which might allow remote attackers to obtain sensitive information about the IdentityServer authorizat…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01042 Published 2017-08-08 No fix listed CWE-79

Open these records in search →

Critical	0
High	0
Medium	3
Low	0
No CVSS	0