CVSS: 7.5EPSS: 0%CPEs: 28EXPL: 0CVE-2019-10184 – undertow: Information leak in requests for directories without trailing slashes
https://notcve.org/view.php?id=CVE-2019-10184
undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api. Undertow en versiones anteriores a la 2.0.23.Final es vulnerable a un problema de fuga de información. Las aplicaciones web pueden tener sus estructuras de directorio predecibles a través de solicitudes sin barras finales mediante la API. • https://access.redhat.com/errata/RHSA-2019:2935 https://access.redhat.com/errata/RHSA-2019:2936 https://access.redhat.com/errata/RHSA-2019:2937 https://access.redhat.com/errata/RHSA-2019:2938 https://access.redhat.com/errata/RHSA-2019:2998 https://access.redhat.com/errata/RHSA-2019:3044 https://access.redhat.com/errata/RHSA-2019:3045 https://access.redhat.com/errata/RHSA-2019:3046 https://access.redhat.com/errata/RHSA-2019:3050 https://access.redhat.com/errata/RHSA • CWE-862: Missing Authorization •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2019-10157 – keycloak: Node.js adapter internal NBF can be manipulated leading to DoS.
https://notcve.org/view.php?id=CVE-2019-10157
It was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from the server in its backchannel logout . An attacker with local access could use this to construct a malicious web token setting an NBF parameter that could prevent user access indefinitely. Se encontró que el adaptador Node.js de Keycloak antes de la versión 4.8.3 no verificó correctamente el token web recibido del servidor en su cierre de sesión de backchannel. Un atacante con acceso local podría usar esto para construir un token web malicioso que establezca un parámetro NBF que podría impedir el acceso de los usuarios de forma indefinida. It was found that Keycloak's Node.js adapter did not properly verify the web token received from the server in its backchannel logout. • http://www.securityfocus.com/bid/108734 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10157 https://access.redhat.com/security/cve/CVE-2019-10157 https://bugzilla.redhat.com/show_bug.cgi?id=1702953 • CWE-287: Improper Authentication CWE-345: Insufficient Verification of Data Authenticity •
CVSS: 5.4EPSS: 0%CPEs: 5EXPL: 0CVE-2019-3872 – picketlink: reflected XSS in SAMLRequest via RelayState parameter
https://notcve.org/view.php?id=CVE-2019-3872
It was found that a SAMLRequest containing a script could be processed by Picketlink versions shipped in Jboss Application Platform 7.2.x and 7.1.x. An attacker could use this to send a malicious script to achieve cross-site scripting and obtain unauthorized information or conduct further attacks. Se encontró que un SAMLRequest que contenía un script podía ser procesado por versiones de Picketlink enviadas en Jboss Application Platform 7.2.xy 7.1.x. Un atacante podría usar esto para enviar un script malicioso para lograr scripts entre sitios y obtener información no autorizada o lleva cabo de más ataques. • http://www.securityfocus.com/bid/108732 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3872 https://access.redhat.com/security/cve/CVE-2019-3872 https://bugzilla.redhat.com/show_bug.cgi?id=1688966 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 0%CPEs: 5EXPL: 0CVE-2019-3873 – picketlink: URL injection via xinclude parameter
https://notcve.org/view.php?id=CVE-2019-3873
It was found that Picketlink as shipped with Jboss Enterprise Application Platform 7.2 would accept an xinclude parameter in SAMLresponse XML. An attacker could use this flaw to send a URL to achieve cross-site scripting or possibly conduct further attacks. Se encontró que Picketlink, tal como se distribuye con Jboss Enterprise Application Platform versión 7.2, aceptaría un parámetro xinclude en XML SAMLresponse. Un atacante podría usar esta fallo para enviar una URL para lograr cross-site scripting o posiblemente conducir más ataques. • http://www.securityfocus.com/bid/108739 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3873 https://access.redhat.com/security/cve/CVE-2019-3873 https://bugzilla.redhat.com/show_bug.cgi?id=1689014 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 5EXPL: 0CVE-2018-10934 – wildfly-core: Cross-site scripting (XSS) in JBoss Management Console
https://notcve.org/view.php?id=CVE-2018-10934
A cross-site scripting (XSS) vulnerability was found in the JBoss Management Console versions before 7.1.6.CR1, 7.1.6.GA. Users with roles that can create objects in the application can exploit this to attack other privileged users. Se ha descubierto una vulnerabilidad Cross-Site Scripting (XSS) en JBoss Management Console, en versiones anteriores a la 7.1.6.CR1 y la 7.1.6.GA. Los usuarios con roles que pueden crear objetos en la aplicación pueden explotar esto para atacar a otros usuarios privilegiados. • https://access.redhat.com/errata/RHSA-2019:1159 https://access.redhat.com/errata/RHSA-2019:1160 https://access.redhat.com/errata/RHSA-2019:1161 https://access.redhat.com/errata/RHSA-2019:1162 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10934 https://security.netapp.com/advisory/ntap-20190611-0002 https://access.redhat.com/security/cve/CVE-2018-10934 https://bugzilla.redhat.com/show_bug.cgi?id=1615673 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •