Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Advisory: Red Hat Single Sign-On 7, Red Hat Single Sign-On 7.6 for RHEL 7 and 2 more products — RHSA-2023:1045 Clear all filters
TI-2022-03783 CVE-2022-4137 · GHSA-9hhc-pj4w-w5rv

Keycloak: reflected xss attack

Priority LOW 38

A reflected cross-site scripting (XSS) vulnerability was found in the 'oob' OAuth endpoint due to incorrect null-byte handling.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.01193 Published 2023-09-25 Fixed in 18.0.6-1.redhat_00001.1.el7sso, 18.0.6-1.redhat_00001.1.el8sso +2 CWE-81
TI-2022-03591 CVE-2022-3916 · GHSA-97g8-xfvw-q4hg

Keycloak: session takeover with oidc offline refreshtokens

Priority LOW 34

A flaw was found in the offline_access scope in Keycloak.

CVSS 3.1MEDIUM 6.8 Network Low privileges No interaction EPSS 0.00952 Published 2023-09-20 Fixed in 18.0.3-1.redhat_00002.1.el7sso, 18.0.6-1.redhat_00001.1.el7sso +7 CWE-384