https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 16:58:29 +0000 https://cve.radiocsirt.org/vuln/cnvd-2017-35297 cnvd-2017-35297 https://cve.radiocsirt.org/vuln/cnvd-2017-35297 https://cve.radiocsirt.org/vuln/euvd-2026-168646 EUVD-2026-168646 https://cve.radiocsirt.org/vuln/euvd-2026-168646 https://cve.radiocsirt.org/vuln/fkie_cve-2017-12160 <p>It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself continued permissions and possibly conduct further attacks.</p> <p>It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself continued permissions and possibly conduct further attacks.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2017-12160 https://cve.radiocsirt.org/vuln/ghsa-qc72-gfvw-76h7 <p><strong>Affected:</strong> Maven: org.keycloak:keycloak-parent</p> <p>It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself continued permissions and possibly conduct further attacks.</p> <p><strong>Affected:</strong> Maven: org.keycloak:keycloak-parent</p> <p>It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself continued permissions and possibly conduct further attacks.</p> https://cve.radiocsirt.org/vuln/ghsa-qc72-gfvw-76h7 https://cve.radiocsirt.org/vuln/gsd-2017-12160 gsd-2017-12160 https://cve.radiocsirt.org/vuln/gsd-2017-12160 https://cve.radiocsirt.org/vuln/rhsa-2017:2904 <p>jasypt: Vulnerable to timing attack against the password hash comparison keycloak: reflected XSS using HOST header keycloak: CSRF token fixation keycloak: resource privilege extension via access token in oauth libpam4j: Account check bypass</p> <p>jasypt: Vulnerable to timing attack against the password hash comparison keycloak: reflected XSS using HOST header keycloak: CSRF token fixation keycloak: resource privilege extension via access token in oauth libpam4j: Account check bypass</p> https://cve.radiocsirt.org/vuln/rhsa-2017:2904