CVE-2021-22696 vulnerabilities and exploits

(subscribe to this query)

CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT token as opposed to query parameters (see: The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request (JAR)). Instead of sending a JWT token as a "request" parameter, the spec als...

Apache Cxf Oracle Business Intelligence 5.5.0.0.0 Oracle Business Intelligence 5.9.0.0.0 Oracle Business Intelligence 12.2.1.3.0 Oracle Business Intelligence 12.2.1.4.0 Oracle Communications Diameter Intelligence Hub Oracle Communications Element Manager 8.2.2 Oracle Communications Session Report Manager Oracle Communications Session Route Manager

This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and prior to 2.11.4, from 2.12.0-rc1 and prior to 2.12.1. Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception.

Fasterxml Jackson-dataformats-binary Fasterxml Jackson-dataformats-binary 2.12.0 Quarkus Quarkus Oracle Weblogic Server 12.2.1.3.0 Oracle Weblogic Server 12.2.1.4.0 Oracle Weblogic Server 14.1.1.0.0

A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role.

Infinispan Infinispan Redhat Data Grid 8.0 Netapp Active Iq Unified Manager -

A flaw was found in Keycloak Gatekeeper (Louketo). The logout endpoint can be abused to redirect logged-in users to arbitrary web pages. Affected versions of Keycloak Gatekeeper (Louketo): 6.0.1, 7.0.0

Keycloak Gatekeeper Project Keycloak Gatekeeper 6.0.1 Keycloak Gatekeeper Project Keycloak Gatekeeper 7.0.0 Redhat Mobile Application Platform 4.0

A flaw was found in keycloak before version 13.0.0. In some scenarios a user still has access to a resource after changing the role mappings in Keycloak and after expiration of the previous access token.

Redhat Keycloak

A flaw was found in keycloak. The new account console in keycloak can allow malicious code to be executed using the referrer URL. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Redhat Keycloak

A flaw was found in keycloak as shipped in Red Hat Single Sign-On 7.4 where IDN homograph attacks are possible. A malicious user can register himself with a name already registered and trick admin to grant him extra privileges.

Redhat Single Sign-on 7.4

Bouncy Castle BC Java prior to 1.66, BC C# .NET prior to 1.8.7, BC-FJA prior to 1.0.1.2, 1.0.2.1, and BC-FNA prior to 1.0.1.1 have a timing issue within the EC math library that can expose information about the private key when an attacker is able to observe timing information fo...

Bouncycastle Bc-csharp Bouncycastle Bouncy Castle Fips .net Api Bouncycastle Legion-of-the-bouncy-castle-fips-java-api Bouncycastle The Bouncy Castle Crypto Package For Java

2 Github repositories

A flaw was found in all resteasy 3.x.x versions before 3.12.0.Final and all resteasy 4.x.x versions before 4.6.0.Final, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection,...

Redhat Resteasy Fedoraproject Fedora 32 Fedoraproject Fedora 33

A flaw was found in keycloak in versions before 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients (like client secret) without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL later. The highest threa...

Redhat Keycloak Redhat Single Sign-on 7.0

2 Github repositories

1 2 3 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook