Keycloak vulnerable to cross-site scripting via the state parameter

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2018-14655 · ADVISORY
• access.redhat.com/errata/RHSA-2018:3592 · WEB
• access.redhat.com/errata/RHSA-2018:3593 · WEB
• access.redhat.com/errata/RHSA-2018:3595 · WEB
• bugzilla.redhat.com/show_bug.cgi · WEB
• keycloak/keycloak · PACKAGE

Lỗ hổng khác của org.keycloak:keycloak-parent

• CVE-2026-0707TRUNG BÌNH 5.3A flaw was found in Keycloak. The Keycloak Authorization header parser is overly permissive regarding the formatting of the "Bearer" authent…
• CVE-2022-4137TRUNG BÌNH 6.1A reflected cross-site scripting (XSS) vulnerability was found in the 'oob' OAuth endpoint due to incorrect null-byte handling. This issue a…
• CVE-2022-3916TRUNG BÌNH 6.8A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are …
• CVE-2022-3782NGHIÊM TRỌNG 9.1keycloak: path traversal via double URL encoding. A flaw was found in Keycloak, where it does not properly validate URLs included in a redir…
• CVE-2022-2256THẤP 3.8A Stored Cross-site scripting (XSS) vulnerability was found in keycloak as shipped in Red Hat Single Sign-On 7. This flaw allows a privilege…