Red Hat Single Sign-on 7.2
Approved changes feed: RSS · Atom
cpe:2.3:a:redhat:single_sign-on:7.2:*:*:*:*:*:*:*
part: a version: 7.2 update: *
| Vendor | Redhat (e942785a-ca89-506e-bd99-50782639cde3) |
|---|---|
| Product | Single Sign On (2da82ce9-a16b-5290-b161-4a01040f7fcb) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2018-14657 |
vulnerable | 2026-06-08 05:10:53.236949 |
Details available
MEDIUM (5.4)
A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. When TOPT enabled, an improper implementation of the Brute Force detection algorithm will not enforce its protection measures.
Published: 2018-11-13T19:00:00.000Z
Updated: 2024-08-05T09:38:13.017Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-14655 |
vulnerable | 2026-06-08 05:10:53.232291 |
Details available
MEDIUM (4.6)
A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. When using 'response_mode=form_post' it is possible to inject arbitrary Javascript-Code via the 'state'-parameter in the authentication URL. This allows an XSS-Attack upon succesfully login.
Published: 2018-11-13T19:00:00.000Z
Updated: 2024-08-05T09:38:13.384Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-10934 |
vulnerable | 2026-06-08 05:10:37.409924 |
Details available
MEDIUM (5.4)
A cross-site scripting (XSS) vulnerability was found in the JBoss Management Console versions before 7.1.6.CR1, 7.1.6.GA. Users with roles that can create objects in the application can exploit this to attack other privileged users.
Published: 2019-03-27T12:20:07.000Z
Updated: 2024-08-05T07:54:36.087Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-10912 |
vulnerable | 2026-06-08 05:10:37.354719 |
Details available
MEDIUM (4.4)
keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired session replacement and lead to an infinite loop. A malicious authenticated user could use this flaw to achieve Denial of Service on the server.
Published: 2018-07-23T22:00:00.000Z
Updated: 2024-08-05T07:54:36.292Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-10894 |
vulnerable | 2026-06-08 05:10:37.314250 |
Details available
MEDIUM (5.4)
It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates. A malicious user could use this to access unauthorized data or possibly conduct further attacks.
Published: 2018-08-01T17:00:00.000Z
Updated: 2024-08-05T07:54:34.911Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.