Security advisories

medium2024-04-17

CVE-2023-6787-Keycloak vulnerable to session hijacking via re-authentication

keycloak/keycloak · GHSA-c9h6-v78w-52wj

high2024-04-17

CVE-2024-1132-Keycloak path traversal vulnerability in redirection validation

keycloak/keycloak · GHSA-72vp-xfrc-42xm

high2024-04-17

CVE-2024-1249-Keycloak's unvalidated cross-origin messages in checkLoginIframe leads to DDoS

keycloak/keycloak · GHSA-m6q9-p373-g5q8

medium2024-04-17

CVE-2023-6484-Keycloak vulnerable to log Injection during WebAuthn authentication or registration

keycloak/keycloak · GHSA-j628-q885-8gr5

high2024-04-17

CVE-2024-21409-.NET Elevation of Privilege Vulnerability

dotnet/wpf · GHSA-6qmx-42h2-j8h6

high2024-04-17

CVE-2024-30253-Handling untrusted input can result in a crash, leading to loss of availability / denial of service

solana-labs/solana-web3.js · GHSA-8m45-2rjm-j347

medium2024-04-17

CVE-2024-29035-Blind SSRF Leads to Port Scan by using Webhooks

umbraco/umbraco-cms · GHSA-74p6-39f2-23v3

medium2024-04-17

Evmos vulnerable to unauthorized account creation with vesting module

evmos/evmos · GHSA-m99c-q26r-m7m7

critical2024-04-17

Evmos vulnerable to DOS and transaction fee expropiation through Authz exploit

evmos/evmos · GHSA-v6rw-hhgg-wc4x

medium2024-04-17

CVE-2023-6544-Keycloak Authorization Bypass vulnerability

keycloak/keycloak · GHSA-46c8-635v-68r2

medium2024-04-17

CVE-2023-6717-Keycloak Cross-site Scripting (XSS) via assertion consumer service URL in SAML POST-binding flow

keycloak/keycloak · GHSA-8rmm-gm28-pj8q

medium2024-04-17

CVE-2023-3597-Keycloak secondary factor bypass in step-up authentication

keycloak/keycloak · GHSA-4f53-xh3v-g8x4

high2024-04-17

CVE-2024-2419-Keycloak path traversal vulnerability in the redirect validation

keycloak/keycloak · GHSA-mrv8-pqfj-7gp5

medium2024-04-17

CVE-2024-3825-BlazeMeter Jenkins plugin vulnerable to Cross-Site Request Forgery

blazemeter/blazemeter-jenkins-plugin · GHSA-r52h-fjm7-93j8

high2024-04-17

CVE-2024-31503-Dolibarr vulnerable to Cross-Site Request Forgery

dolibarr/dolibarr · GHSA-6ppg-rgrg-f573

high2024-04-17

CVE-2024-32463-Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `<a>` tags

phlex-ruby/phlex · GHSA-g7xq-xv8c-h98c

high2024-04-16

CVE-2024-31452-OpenFGA Authorization Bypass

openfga/openfga · GHSA-8cph-m685-6v6r

low2024-04-16

CVE-2024-27086-MSAL.NET applications targeting Xamarin Android and .NET Android (MAUI) susceptible to local denial of service

azuread/microsoft-authentication-library-for-dotnet · GHSA-x674-v45j-fwxw

critical2024-04-16

CVE-2024-3660-Keras code injection vulnerability

keras-team/keras · GHSA-x4wf-678h-2pmq

high2024-04-16

CVE-2024-22262-Spring Framework URL Parsing with Host Validation

spring-projects/spring-framework · GHSA-2wrp-6fg6-hmc5