CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2020-35509 – keycloak: X509 Direct Grant Auth does not verify certificate timestamp validity
https://notcve.org/view.php?id=CVE-2020-35509
A flaw was found in keycloak affecting versions 11.0.3 and 12.0.0. An expired certificate would be accepted by the direct-grant authenticator because of missing time stamp validations. The highest threat from this vulnerability is to data confidentiality and integrity. Se ha encontrado un fallo en keycloak afectado a versiones 11.0.3 y 12.0.0. Un certificado caducado sería aceptado por el autenticador de concesión directa debido a una falta de comprobaciones de la marca de tiempo. • https://access.redhat.com/security/cve/cve-2020-35509 https://access.redhat.com/security/cve/CVE-2020-35509 https://bugzilla.redhat.com/show_bug.cgi?id=1912427 • CWE-20: Improper Input Validation CWE-295: Improper Certificate Validation •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-3637 – keycloak-model-infinispan: authenticationSessions map in RootAuthenticationSessionEntity grows boundlessly could lead to a DoS attack
https://notcve.org/view.php?id=CVE-2021-3637
A flaw was found in keycloak-model-infinispan in keycloak versions before 14.0.0 where authenticationSessions map in RootAuthenticationSessionEntity grows boundlessly which could lead to a DoS attack. Se ha encontrado un fallo en keycloak-model-infinispan en keycloak versiones anteriores a 14.0.0, donde el mapa authenticationSessions en RootAuthenticationSessionEntity crece ilimitadamente, lo que podría conllevar a un ataque de DoS A flaw was found in keycloak-model-infinispan where the authenticationSessions map in RootAuthenticationSessionEntity grows boundlessly. This issue leads to a denial of service. • https://bugzilla.redhat.com/show_bug.cgi?id=1979638 https://access.redhat.com/security/cve/CVE-2021-3637 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 9.6EPSS: 0%CPEs: 1EXPL: 0CVE-2021-20195
https://notcve.org/view.php?id=CVE-2021-20195
A flaw was found in keycloak in versions before 13.0.0. A Self Stored XSS attack vector escalating to a complete account takeover is possible due to user-supplied data fields not being properly encoded and Javascript code being used to process the data. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Se encontró un fallo en keycloak en versiones anteriores a 13.0.0. Es posible que se produzca un vector de ataque de tipo XSS Autoalmacenado escalando en una toma de control completa de la cuenta debido a que los campos de datos suministrados por el usuario no sean codificados apropiadamente y es usado código Javascript para procesar los datos. • https://bugzilla.redhat.com/show_bug.cgi?id=1919143 • CWE-20: Improper Input Validation CWE-116: Improper Encoding or Escaping of Output •
CVSS: 7.3EPSS: 0%CPEs: 1EXPL: 0CVE-2021-20202
https://notcve.org/view.php?id=CVE-2021-20202
A flaw was found in keycloak. Directories can be created prior to the Java process creating them in the temporary directory, but with wider user permissions, allowing the attacker to have access to the contents that keycloak stores in this directory. The highest threat from this vulnerability is to data confidentiality and integrity. Se ha encontrado un defecto en keycloak. Los Directorios pueden ser creados antes del proceso de Java que los crea en el directorio temporal, pero con permisos de usuario más amplios, permitiendo a un atacante tener acceso a los contenidos que keycloak almacena en este directorio. • https://bugzilla.redhat.com/show_bug.cgi?id=1922128 • CWE-377: Insecure Temporary File •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-20222
https://notcve.org/view.php?id=CVE-2021-20222
A flaw was found in keycloak. The new account console in keycloak can allow malicious code to be executed using the referrer URL. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Se encontró un fallo en keycloak. La nueva consola de cuentas en keycloak puede permitir que sea ejecutado un código malicioso usando la URL de referencia. • https://bugzilla.redhat.com/show_bug.cgi?id=1924606 • CWE-20: Improper Input Validation CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •