https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 06:11:36 +0000 https://cve.radiocsirt.org/vuln/cnvd-2020-04661 cnvd-2020-04661 https://cve.radiocsirt.org/vuln/cnvd-2020-04661 https://cve.radiocsirt.org/vuln/euvd-2026-35568 EUVD-2026-35568 https://cve.radiocsirt.org/vuln/euvd-2026-35568 https://cve.radiocsirt.org/vuln/fkie_cve-2020-1697 <p>It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user could create URLs to trick users in other realms, and possibly conduct further attacks.</p> <p>It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user could create URLs to trick users in other realms, and possibly conduct further attacks.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2020-1697 https://cve.radiocsirt.org/vuln/ghsa-8vf3-4w62-m3pq <p><strong>Affected:</strong> Maven: org.keycloak:keycloak-core</p> <p>It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user could create URLs to trick users in other realms, and possibly conduct further attacks.</p> <p><strong>Affected:</strong> Maven: org.keycloak:keycloak-core</p> <p>It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user could create URLs to trick users in other realms, and possibly conduct further attacks.</p> https://cve.radiocsirt.org/vuln/ghsa-8vf3-4w62-m3pq https://cve.radiocsirt.org/vuln/gsd-2020-1697 gsd-2020-1697 https://cve.radiocsirt.org/vuln/gsd-2020-1697 https://cve.radiocsirt.org/vuln/rhsa-2020:0445 <p>xstream: remote code execution due to insecure XML deserialization (regression of CVE-2013-7285) hibernate-validator: safeHTML validator allows XSS jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariConfig undertow: possible Denial Of Service (DOS) in Undertow HTTP server listening on HTTPS jackson-databind: Serialization gadgets in classes of the commons-configuration package jackson-databind: Serialization gadgets in classes of the xalan package jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariDataSource netty: HTTP request smuggling by mishandled whitespace before the colon in HTTP headers jackson-databind: Serialization gadgets in org.apache.commons.dbcp.datasources.* jackson-databind: Serialization gadgets in com.p6spy.engine.spy.P6DataSource jackson-databind: Serialization gadgets in classes of the ehcache package jackson-databind: Serialization gadgets in org.apache.log4j.receivers.db.* keycloak: stored XSS in client settings via application links</p> <p>xstream: remote code execution due to insecure XML deserialization (regression of CVE-2013-7285) hibernate-validator: safeHTML validator allows XSS jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariConfig undertow: possible Denial Of Service (DOS) in Undertow HTTP server listening on HTTPS jackson-databind: Serialization gadgets in classes of the commons-configuration package jackson-databind: Serialization gadgets in classes of the xalan package jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariDataSource netty: HTTP request smuggling by mishandled whitespace before the colon in HTTP headers jackson-databind: Serialization gadgets in org.apache.commons.dbcp.datasources.* jackson-databind: Serialization gadgets in com.p6spy.engine.spy.P6DataSource jackson-databind: Serialization gadgets in classes of the ehcache package jackson-databind: Serialization gadgets in org.apache.log4j.receivers.db.* keycloak: stored XSS in client settings via application links</p> https://cve.radiocsirt.org/vuln/rhsa-2020:0445