CVSS: 4.8EPSS: 0%CPEs: 7EXPL: 0CVE-2017-15881
https://notcve.org/view.php?id=CVE-2017-15881
24 Oct 2017 — Cross-Site Scripting vulnerability in KeystoneJS before 4.0.0-beta.7 allows remote authenticated administrators to inject arbitrary web script or HTML via the "content brief" or "content extended" field, a different vulnerability than CVE-2017-15878. Vulnerabilidad Cross-Site Scripting (XSS) en KeystoneJS en versiones anteriores a la 4.0.0-beta.7 permite que administradores autenticados remotos inyecten scripts web o HTML arbitrarios mediante el campo "content brief" o "content extended". Esta es una vulner... • http://blog.securelayer7.net/keystonejs-open-source-penetration-testing-report • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 4%CPEs: 1EXPL: 3CVE-2017-15878 – KeystoneJS 4.0.0-beta.5 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2017-15878
24 Oct 2017 — A cross-site scripting (XSS) vulnerability exists in fields/types/markdown/MarkdownType.js in KeystoneJS before 4.0.0-beta.7 via the Contact Us feature. Existe una vulnerabilidad de Cross-Site Scripting (XSS) en fields/types/markdown/MarkdownType.js en KeystoneJS en versiones anteriores a la 4.0.0-beta.7 mediante la característica Contact Us. KeystoneJS version 4.0.0-beta.5 suffers from an unauthenticated stored cross site scripting vulnerability. • https://packetstorm.news/files/id/144756 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 10%CPEs: 1EXPL: 2CVE-2017-15879 – KeystoneJS 4.0.0-beta.5 - CSV Excel Macro Injection
https://notcve.org/view.php?id=CVE-2017-15879
24 Oct 2017 — CSV Injection (aka Excel Macro Injection or Formula Injection) exists in admin/server/api/download.js and lib/list/getCSVData.js in KeystoneJS before 4.0.0-beta.7 via a value that is mishandled in a CSV export. Existe inyección de CSV (también conocido como Excel Macro Injection or Formula Injection) en admin/server/api/download.js y lib/list/getCSVData.js en KeystoneJS en versiones anteriores a la 4.0.0-beta.7 mediante un valor que no se gestiona de manera correcta en una exportación de CSV. KeystoneJS ver... • https://packetstorm.news/files/id/144755 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 0CVE-2014-5251 – openstack-keystone: revocation events are broken with mysql
https://notcve.org/view.php?id=CVE-2014-5251
21 Aug 2014 — The MySQL token driver in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 stores timestamps with the incorrect precision, which causes the expiration comparison for tokens to fail and allows remote authenticated users to retain access via an expired token. El controlador de los tokens MySQL en OpenStack Identity (Keystone) 2014.1.x anterior a 2014.1.2.1 y Juno anterior a Juno-3 almacena las marcas del tiempo (timestamps) con la precisión incorrecta, lo que causa que falle la ... • http://rhn.redhat.com/errata/RHSA-2014-1121.html • CWE-255: Credentials Management Errors CWE-613: Insufficient Session Expiration •
CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 0CVE-2014-5252 – openstack-keystone: token expiration date stored incorrectly
https://notcve.org/view.php?id=CVE-2014-5252
21 Aug 2014 — The V3 API in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issued_at value for UUID v2 tokens, which allows remote authenticated users to bypass the token expiration and retain access via a verification (1) GET or (2) HEAD request to v3/auth/tokens/. La API V3 en OpenStack Identity (Keystone) 2014.1.x anterior a 2014.1.2.1 y Juno anterior a Juno-3 actualiza el valor issued_at para los tokens UUID v2, loque permite a usuarios remotos autenticados evadir la caduc... • http://rhn.redhat.com/errata/RHSA-2014-1121.html • CWE-255: Credentials Management Errors CWE-613: Insufficient Session Expiration •
CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 0CVE-2014-5253 – openstack-keystone: domain-scoped tokens don't get revoked
https://notcve.org/view.php?id=CVE-2014-5253
21 Aug 2014 — OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 does not properly revoke tokens when a domain is invalidated, which allows remote authenticated users to retain access via a domain-scoped token for that domain. OpenStack Identity (Keystone) 2014.1.x anterior a 2014.1.2.1 y Juno anterior a Juno-3 no revoca debidamente los tokens cuando un dominio está invalidado, lo que permite a usuarios remotos autenticados conservar el acceso a través de un token 'domain-scoped' para este do... • http://rhn.redhat.com/errata/RHSA-2014-1121.html • CWE-255: Credentials Management Errors CWE-613: Insufficient Session Expiration •