redhat single sign-on 7.2 vulnerabilities and exploits

(subscribe to this query)

4

CVSSv2

keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired session replacement and lead to an infinite loop. A malicious authenticated user could use this flaw to achieve Denial of...

Redhat Keycloak Redhat Single Sign-on 7.2

6.5

CVSSv2

A flaw was found in Wildfly Security Manager, running under JDK 11 or 8, that authorized requests for any requester. This flaw could be used by a malicious app deployed on the app server to access unauthorized information and possibly conduct further attacks. Versions shipped wit...

Redhat Single Sign-on 7.3 Redhat Jboss Enterprise Application Platform 7.2.0 Redhat Single Sign-on -

1 Github repository

3.5

CVSSv2

A cross-site scripting (XSS) vulnerability was found in the JBoss Management Console versions prior to 7.1.6.CR1, 7.1.6.GA. Users with roles that can create objects in the application can exploit this to attack other privileged users.

Redhat Jboss Enterprise Application Platform 7.0 Redhat Jboss Enterprise Application Platform 7.1.0 Redhat Single Sign-on 7.2

5.8

CVSSv2

A flaw exists in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an malicious user to poison a web-cache, ...

Redhat Undertow Redhat Single Sign-on -Redhat Jboss Enterprise Application Platform -Redhat Jboss Enterprise Application Platform 7.2 Redhat Jboss Enterprise Application Platform 7.3 Redhat Jboss Enterprise Application Platform 7.4

6

CVSSv2

It was found that Picketlink as shipped with Jboss Enterprise Application Platform 7.2 would accept an xinclude parameter in SAMLresponse XML. An attacker could use this flaw to send a URL to achieve cross-site scripting or possibly conduct further attacks.

Redhat Jboss Enterprise Application Platform 7.2.0 Redhat Single Sign-on 7.0

3.5

CVSSv2

It was found that a SAMLRequest containing a script could be processed by Picketlink versions shipped in Jboss Application Platform 7.2.x and 7.1.x. An attacker could use this to send a malicious script to achieve cross-site scripting and obtain unauthorized information or conduc...

Redhat Jboss Enterprise Application Platform 7.2.0 Redhat Single Sign-on 7.0

5

CVSSv2

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.

Redhat Undertow Redhat Jboss Data Grid -Redhat Jboss Enterprise Application Platform -Redhat Jboss Enterprise Application Platform 7.0.0 Redhat Openshift Application Runtimes -Redhat Openshift Application Runtimes 1.0 Redhat Single Sign-on -Redhat Single Sign-on 7.0 Redhat Jboss Enterprise Application Platform 7.2 Redhat Jboss Enterprise Application Platform 7.3 Redhat Jboss Enterprise Application Platform 7.4 Redhat Single Sign-on 7.3 Netapp Active Iq Unified Manager -

1 Github repository

6.5

CVSSv2

A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious be...

Infinispan Infinispan Redhat Fuse 1.0 Redhat Jboss Data Grid -Redhat Jboss Enterprise Application Platform -Redhat Openshift Application Runtimes -Redhat Single Sign-on -Redhat Jboss Enterprise Application Platform 7.2 Netapp Active Iq Unified Manager -

4

CVSSv2

A vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with Red Hat JBoss EAP 7, where SessionOpenInvocations are never removed from the remote InvocationTracker after a response is received in the EJB Client, as well as the server. This flaw all...

Redhat Jboss Fuse 6.0.0 Redhat Single Sign-on 7.0 Redhat Openshift Application Runtimes -Redhat Jboss Enterprise Application Platform Continuous Delivery -Redhat Amq 2.0

4

CVSSv2

It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an malicious user to access unauthorized information.

Redhat Keycloak Redhat Single Sign-on 7.3 Redhat Jboss Enterprise Application Platform 6.4.0 Redhat Jboss Enterprise Application Platform 7.2.0 Redhat Jboss Fuse 7.0.0

Get Started

1 2 3 4 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook