Vulmon
Recent Vulnerabilities
Product List
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
redhat single sign-on - vulnerabilities and exploits
(subscribe to this query)
7.8
CVSSv3
CVE-2020-10695
An insecure modification flaw in the /etc/passwd file was found in the redhat-sso-7 container. An attacker with access to the container can use this flaw to modify the /etc/passwd and escalate their privileges.
Redhat Single Sign-on
5.5
CVSSv3
CVE-2019-10157
It was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from the server in its backchannel logout . An attacker with local access could use this to construct a malicious web token setting an NBF parameter that could pr...
Redhat Single Sign-on
Redhat Keycloak
3.8
CVSSv3
CVE-2022-2256
A Stored Cross-site scripting (XSS) vulnerability was found in keycloak as shipped in Red Hat Single Sign-On 7. This flaw allows a privileged malicious user to execute malicious scripts in the admin console, abusing the default roles functionality.
Redhat Single Sign-on 7.0
5.3
CVSSv3
CVE-2021-3424
A flaw was found in keycloak as shipped in Red Hat Single Sign-On 7.4 where IDN homograph attacks are possible. A malicious user can register himself with a name already registered and trick admin to grant him extra privileges.
Redhat Single Sign-on 7.4
4.9
CVSSv3
CVE-2018-10912
keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired session replacement and lead to an infinite loop. A malicious authenticated user could use this flaw to achieve Denial of...
Redhat Keycloak
Redhat Single Sign-on 7.2
4.8
CVSSv3
CVE-2019-3875
A vulnerability was found in keycloak prior to 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL list can be obtained from the URL provided in the certificate itself (CDP) or through the separately configured path. The ...
Redhat Single Sign-on 7.3
Redhat Keycloak
6.1
CVSSv3
CVE-2022-4137
A reflected cross-site scripting (XSS) vulnerability was found in the 'oob' OAuth endpoint due to incorrect null-byte handling. This issue allows a malicious link to insert an arbitrary URI into a Keycloak error page. This flaw requires a user or administrator to intera...
Redhat Keycloak -
Redhat Single Sign-on 7.6
6.5
CVSSv3
CVE-2022-1466
Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be allowed to perform. It was possible to add users to the master realm even though no respective permission was granted.
Redhat Keycloak
Redhat Single Sign-on 7.5.0
5.4
CVSSv3
CVE-2022-0225
A flaw was found in Keycloak. This flaw allows a privileged malicious user to use the malicious payload as the group name while creating a new group from the admin console, leading to a stored Cross-site scripting (XSS) attack.
Redhat Keycloak -
Redhat Single Sign-on 7.0
6.5
CVSSv3
CVE-2020-27838
A flaw was found in keycloak in versions before 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients (like client secret) without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL later. The highest threa...
Redhat Single Sign-on 7.0
Redhat Keycloak
2 Github repositories
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
log injection
CVE-2024-37079
type confusion
CVE-2024-32943
CVE-2024-30103
CVE-2024-37350
arbitrary code
CVE-2024-6189
CVE-2024-6225
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
7
NEXT »