CVSS: 3.3EPSS: 0%CPEs: 4EXPL: 0CVE-2020-10734
https://notcve.org/view.php?id=CVE-2020-10734
A vulnerability was found in keycloak in the way that the OIDC logout endpoint does not have CSRF protection. Versions shipped with Red Hat Fuse 7, Red Hat Single Sign-on 7, and Red Hat Openshift Application Runtimes are believed to be vulnerable. Se encontró una vulnerabilidad en keycloak en la forma en que el endpoint de cierre de sesión OIDC no tiene protección CSRF. Se cree que las versiones enviadas con Red Hat Fuse 7, Red Hat Single Sign-on 7 y Red Hat Openshift Application Runtimes son vulnerables • https://bugzilla.redhat.com/show_bug.cgi?id=1831662 https://issues.redhat.com/browse/KEYCLOAK-13653 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.0EPSS: 0%CPEs: 4EXPL: 0CVE-2020-1717
https://notcve.org/view.php?id=CVE-2020-1717
A flaw was found in Keycloak 7.0.1. A logged in user can do an account email enumeration attack. Se encontró un fallo en Keycloak versión 7.0.1. Un usuario que haya iniciado sesión puede llevar a cabo un ataque de enumeración de correo electrónico de la cuenta • https://bugzilla.redhat.com/show_bug.cgi?id=1796281 https://issues.jboss.org/browse/KEYCLOAK-12014 • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2020-27782 – undertow: special character in query results in server errors
https://notcve.org/view.php?id=CVE-2020-27782
A flaw was found in the Undertow AJP connector. Malicious requests and abrupt connection closes could be triggered by an attacker using query strings with non-RFC compliant characters resulting in a denial of service. The highest threat from this vulnerability is to system availability. This affects Undertow 2.1.5.SP1, 2.0.33.SP2, and 2.2.3.SP1. Se encontró un fallo en el conector AJP de Undertow. • https://bugzilla.redhat.com/show_bug.cgi?id=1901304 https://access.redhat.com/security/cve/CVE-2020-27782 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.8EPSS: 0%CPEs: 12EXPL: 1CVE-2020-25689 – wildfly-core: memory leak in WildFly host-controller in domain mode while not able to reconnect to domain-controller
https://notcve.org/view.php?id=CVE-2020-25689
A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating new connections which are not properly closed while not able to connect to domain-controller. This flaw allows an attacker to cause an Out of memory (OOM) issue, leading to a denial of service. The highest threat from this vulnerability is to system availability. Se encontró una fallo de filtrado de memoria en WildFly en todas las versiones hasta 21.0.0.Final, donde el controlador de host intenta reconectarse en un bucle, generando nuevas conexiones que no son cerradas apropiadamente mientras no es capaz de conectar al controlador de dominio. Este fallo permite a un atacante causar un problema de Falta de Memoria (OOM), conllevando a una denegación de servicio. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-25689 https://security.netapp.com/advisory/ntap-20201123-0006 https://access.redhat.com/security/cve/CVE-2020-25689 https://bugzilla.redhat.com/show_bug.cgi?id=1893070 • CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 5.9EPSS: 0%CPEs: 21EXPL: 0CVE-2020-14340 – xnio: file descriptor leak caused by growing amounts of NIO Selector file handles may lead to DoS
https://notcve.org/view.php?id=CVE-2020-14340
A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage collection cycles. It may allow the attacker to cause a denial of service. It affects XNIO versions 3.6.0.Beta1 through 3.8.1.Final. Se detectó una vulnerabilidad en XNIO en la que se produce un filtrado de descriptores de archivos causada por el crecimiento de la cantidad de manejadores de archivos NIO Selector entre los ciclos de recolección de basura. Puede permitir al atacante causar una denegación de servicio. • https://bugzilla.redhat.com/show_bug.cgi?id=1860218 https://www.oracle.com/security-alerts/cpuapr2022.html https://www.oracle.com/security-alerts/cpujan2022.html https://access.redhat.com/security/cve/CVE-2020-14340 • CWE-400: Uncontrolled Resource Consumption •