Most recent entries from all

bdu:2023-03467

EUVD-2026-200840

fkie_cve-2022-4361

Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providers. The vulnerability can allow an attacker to execute malicious scripts by setting the AssertionConsumerServiceURL value or the redirect_uri.

GHSA-3p62-6fjh-3p5h — Keycloak vulnerable to cross-site scripting when validating URI-schemes on SAML and OIDC

Affected: Maven: org.keycloak:keycloak-services

AssertionConsumerServiceURL is a Java implementation for SAML Service Providers (org.keycloak.protocol.saml). Affected versions of this package are vulnerable to Cross-site Scripting (XSS).

AssertionConsumerServiceURL allows XSS when sending a crafted SAML XML request.

gsd-2022-4361

RHSA-2023:3883 — Red Hat Security Advisory: Red Hat Single Sign-On 7.6.4 security update on RHEL 7

RHSSO: XSS due to lax URI scheme validation Undertow: Infinite loop in SslConduit during close keycloak: Untrusted Certificate Validation keycloak: oauth client impersonation keycloak: client access via device auth request spoof

WID-SEC-W-2023-1584 — Red Hat Single Sign On: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Single Sign On ausnutzen, um einen Cross-Site Scripting oder Denial of Service Angriff durchzuführen.