CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-2237 – Adapter: Open redirect vulnerability in checkSSO
https://notcve.org/view.php?id=CVE-2022-2237
A flaw was found in the Keycloak Node.js Adapter. This flaw allows an attacker to benefit from an Open Redirect vulnerability in the checkSso function. • https://bugzilla.redhat.com/show_bug.cgi?id=2097007 https://access.redhat.com/security/cve/CVE-2022-2237 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 7.6EPSS: 0%CPEs: 13EXPL: 0CVE-2022-1274 – keycloak: HTML injection in execute-actions-email Admin REST API
https://notcve.org/view.php?id=CVE-2022-1274
A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to Keycloak users and can be misused to perform phishing or other attacks against users. • https://bugzilla.redhat.com/show_bug.cgi?id=2073157 https://github.com/keycloak/keycloak/security/advisories/GHSA-m4fv-gm5m-4725 https://herolab.usd.de/security-advisories/usd-2021-0033 https://access.redhat.com/security/cve/CVE-2022-1274 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-1438 – Keycloak: xss on impersonation under specific circumstances
https://notcve.org/view.php?id=CVE-2022-1438
A flaw was found in Keycloak. Under specific circumstances, HTML entities are not sanitized during user impersonation, resulting in a Cross-site scripting (XSS) vulnerability. Se encontró una falla en Keycloak. En circunstancias específicas, las entidades HTML no se sanitizan durante la suplantación de usuarios, lo que genera una vulnerabilidad de Cross-Site Scripting (XSS). • https://access.redhat.com/errata/RHSA-2023:1043 https://access.redhat.com/errata/RHSA-2023:1044 https://access.redhat.com/errata/RHSA-2023:1045 https://access.redhat.com/errata/RHSA-2023:1047 https://access.redhat.com/errata/RHSA-2023:1049 https://access.redhat.com/security/cve/CVE-2022-1438 https://bugzilla.redhat.com/show_bug.cgi?id=2031904 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-0923 – Odh-notebook-controller-container: missing authorization allows for file contents disclosure
https://notcve.org/view.php?id=CVE-2023-0923
A flaw was found in the Kubernetes service for notebooks in RHODS, where it does not prevent pods from other namespaces and applications from making requests to the Jupyter API. This flaw can lead to file content exposure and other issues. Se encontró una falla en el servicio Kubernetes para portátiles en RHODS, donde no impide que los pods de otros espacios de nombres y aplicaciones realicen solicitudes a la API de Jupyter. Esta falla puede provocar la exposición del contenido del archivo y otros problemas. • https://access.redhat.com/errata/RHSA-2023:0977 https://access.redhat.com/security/cve/CVE-2023-0923 https://bugzilla.redhat.com/show_bug.cgi?id=2171870 • CWE-862: Missing Authorization •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-1095 – kernel: netfilter: NULL pointer dereference in nf_tables due to zeroed list head
https://notcve.org/view.php?id=CVE-2023-1095
In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list -- the list head is all zeroes, this results in a NULL pointer dereference. A NULL pointer dereference flaw was found in the Linux kernel’s netfilter subsystem. The issue could occur due to an error in nf_tables_updtable while freeing a transaction object not placed on the list head. This flaw allows a local, unprivileged user to crash the system, resulting in a denial of service. • https://bugzilla.redhat.com/show_bug.cgi?id=2173973 https://github.com/torvalds/linux/commit/580077855a40741cf511766129702d97ff02f4d9 https://access.redhat.com/security/cve/CVE-2023-1095 • CWE-476: NULL Pointer Dereference •