https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 04:21:23 +0000 https://cve.radiocsirt.org/vuln/cnvd-2019-44531 cnvd-2019-44531 https://cve.radiocsirt.org/vuln/cnvd-2019-44531 https://cve.radiocsirt.org/vuln/euvd-2026-49759 EUVD-2026-49759 https://cve.radiocsirt.org/vuln/euvd-2026-49759 https://cve.radiocsirt.org/vuln/fkie_cve-2019-3875 <p>A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL list can be obtained from the URL provided in the certificate itself (CDP) or through the separately configured path. The CRL are often available over the network through unsecured protocols (&#39;http&#39; or &#39;ldap&#39;) and hence the caller should verify the signature and possibly the certification path. Keycloak currently doesn&#39;t validate signatures on CRL, which can result in a possibility of various attacks like man-in-the-middle.</p> <p>A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL list can be obtained from the URL provided in the certificate itself (CDP) or through the separately configured path. The CRL are often available over the network through unsecured protocols (&#39;http&#39; or &#39;ldap&#39;) and hence the caller should verify the signature and possibly the certification path. Keycloak currently doesn&#39;t validate signatures on CRL, which can result in a possibility of various attacks like man-in-the-middle.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2019-3875 https://cve.radiocsirt.org/vuln/ghsa-38cg-gg9j-q9j9 <p><strong>Affected:</strong> Maven: org.keycloak:keycloak-core</p> <p>A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL list can be obtained from the URL provided in the certificate itself (CDP) or through the separately configured path. The CRL are often available over the network through unsecured protocols (&#39;http&#39; or &#39;ldap&#39;) and hence the caller should verify the signature and possibly the certification path. Keycloak currently doesn&#39;t validate signatures on CRL, which can result in a possibility of various attacks like man-in-the-middle.</p> <p><strong>Affected:</strong> Maven: org.keycloak:keycloak-core</p> <p>A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL list can be obtained from the URL provided in the certificate itself (CDP) or through the separately configured path. The CRL are often available over the network through unsecured protocols (&#39;http&#39; or &#39;ldap&#39;) and hence the caller should verify the signature and possibly the certification path. Keycloak currently doesn&#39;t validate signatures on CRL, which can result in a possibility of various attacks like man-in-the-middle.</p> https://cve.radiocsirt.org/vuln/ghsa-38cg-gg9j-q9j9 https://cve.radiocsirt.org/vuln/gsd-2019-3875 gsd-2019-3875 https://cve.radiocsirt.org/vuln/gsd-2019-3875 https://cve.radiocsirt.org/vuln/rhsa-2019:1456 <p>bootstrap: XSS in the data-target attribute bootstrap: Cross-site Scripting (XSS) in the data-target property of scrollspy bootstrap: XSS in the tooltip data-viewport attribute bootstrap: XSS in the affix configuration target property picketlink: reflected XSS in SAMLRequest via RelayState parameter picketlink: URL injection via xinclude parameter keycloak: missing signatures validation on CRL used to verify client certificates undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed bootstrap: XSS in the tooltip or popover data-template attribute keycloak: Node.js adapter internal NBF can be manipulated leading to DoS. jquery: Prototype pollution in object&#39;s prototype leading to denial of service, remote code execution, or property injection</p> <p>bootstrap: XSS in the data-target attribute bootstrap: Cross-site Scripting (XSS) in the data-target property of scrollspy bootstrap: XSS in the tooltip data-viewport attribute bootstrap: XSS in the affix configuration target property picketlink: reflected XSS in SAMLRequest via RelayState parameter picketlink: URL injection via xinclude parameter keycloak: missing signatures validation on CRL used to verify client certificates undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed bootstrap: XSS in the tooltip or popover data-template attribute keycloak: Node.js adapter internal NBF can be manipulated leading to DoS. jquery: Prototype pollution in object&#39;s prototype leading to denial of service, remote code execution, or property injection</p> https://cve.radiocsirt.org/vuln/rhsa-2019:1456 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-1947 <p>Ein Angreifer kann mehrere Schwachstellen in Red Hat Single Sign On ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, einen Denial of Service Zustand hervorzurufen, Informationen auszuspähen, Sicherheitsvorkehrungen zu umgehen oder beliebigen Programmcode auszuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Red Hat Single Sign On ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, einen Denial of Service Zustand hervorzurufen, Informationen auszuspähen, Sicherheitsvorkehrungen zu umgehen oder beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2022-1947