Red Hat Single Sign On: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 11

• Medium 6.5
  CVE-2019-3875

  Improper Certificate Validation and Insufficient Verification of Data Authenticity in Keycloak

  A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL list can be obtained from the URL provided in the certificate itself (CDP) or through the separately co…

  Red Hat keycloak org.keycloak:keycloak-core Maven
  Jun 12, 2019
• Medium 6.4
  CVE-2019-3873

  It was found that Picketlink as shipped with Jboss Enterprise Application Platform 7.2 would accept an xinclude paramet…

  Red Hat picketlink
  Jun 12, 2019
• Medium 6.1
  CVE-2016-10735 Public exploit

  Bootstrap Cross-site Scripting vulnerability

  In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.

  bootstrap twitter-bootstrap3 twitter-bootstrap3 bootstrap-sass Debian Ubuntu npm Packagist Maven NuGet RubyGems
  Jan 9, 2019
• Medium 6.1
  CVE-2018-14041 Public exploit

  Bootstrap Cross-site Scripting vulnerability

  In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy.

  typo3/cms typo3/cms-core bootstrap org.webjars:bootstrap npm Packagist Maven NuGet RubyGems
  Jul 13, 2018
• Medium 6.1
  CVE-2018-20676

  XSS vulnerability that affects bootstrap

  In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.

  twitter-bootstrap3 bootstrap twitter-bootstrap3 bootstrap Debian Ubuntu npm Packagist Maven NuGet RubyGems
  Jan 9, 2019
• Medium 6.1
  CVE-2018-20677

  bootstrap Cross-site Scripting vulnerability

  In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.

  ceph fluent-bit pytorch twitter-bootstrap3 Debian Ubuntu Azure Linux npm Packagist Maven NuGet RubyGems
  Jan 9, 2019
• Medium 6.1
  CVE-2019-11358 Public exploit EPSS 87%

  XSS in jQuery as used in Drupal, Backdrop CMS, and other products

  jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Obj…

  mediawiki mediawiki django drupal/core Debian Ubuntu Azure Linux Alpine npm Packagist Maven PyPI NuGet RubyGems
  Apr 19, 2019
• Medium 6.1
  CVE-2019-8331 Public exploit EPSS 16%

  Bootstrap Vulnerable to Cross-Site Scripting

  In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.

  ceph fluent-bit pytorch ntopng Debian Ubuntu Azure Linux npm Packagist Maven NuGet RubyGems
  Feb 20, 2019
• Medium 5.4
  CVE-2019-3872

  It was found that a SAMLRequest containing a script could be processed by Picketlink versions shipped in Jboss Applicat…

  Red Hat picketlink
  Jun 12, 2019
• Medium 5.3
  CVE-2019-3888

  Credential exposure through log files in Undertow

  A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUEST_LOGGER…

  Red Hat undertow undertow undertow Debian Ubuntu Maven
  Jun 12, 2019
• Medium 4.7
  CVE-2019-10157

  Forced Logout in keycloak-connect

  It was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from the server in its backchannel logout . An attacker with local access could use this to construct a malicious web token setting an NBF paramet…

  Red Hat keycloak keycloak-connect npm
  Jun 12, 2019

Revision history

1. 2026-10-08 #18

   Neue Updates von Debian aufgenommen

2. 2023-10-15 #17

   Neue Updates von Red Hat aufgenommen

3. 2023-01-23 #16

   Neue Updates von Amazon aufgenommen

4. 2022-12-07 #15

   Neue Updates von Red Hat aufgenommen

5. 2022-11-28 #14

   Neue Updates von Red Hat aufgenommen

6. 2022-11-02 #13

   Neue Updates von Red Hat aufgenommen

7. 2020-12-16 #12

   Neue Updates von Red Hat aufgenommen

8. 2020-11-03 #11

   Neue Updates von Red Hat aufgenommen

9. 2020-09-29 #10

   Neue Updates von Red Hat aufgenommen

10. 2020-08-04 #9

    Neue Updates von Red Hat aufgenommen

11. 2020-07-13 #8

    Neue Updates von Red Hat aufgenommen

12. 2020-04-05 #7

    Neue Updates von Red Hat aufgenommen

13. 2020-01-16 #6

    Neue Updates von Red Hat aufgenommen

14. 2019-11-05 #5

    Exploit aufgenommen

15. 2019-10-10 #4

    Neue Updates von Red Hat aufgenommen

16. 2019-09-04 #3

    Neue Updates von Red Hat aufgenommen

17. 2019-08-12 #2

    Neue Updates von Red Hat aufgenommen

18. 2019-06-11 #1

    Initiale Fassung

References

• Red Hat Security Advisory: RHSA-2019:1456 vom 2019-06-11
  https://access.redhat.com/errata/RHSA-2019:1456
• Red Hat Security Advisory RHSA-2019:2439 vom 2019-08-12
  https://access.redhat.com/errata/RHSA-2019:2439
• Red Hat Security Advisory RHSA-2020:0132 vom 2020-01-16
  https://access.redhat.com/errata/RHSA-2020:0132
• Red Hat Security Advisory RHSA-2020:0133 vom 2020-01-16
  https://access.redhat.com/errata/RHSA-2020:0133
• Red Hat Security Advisory RHSA-2019:2587 vom 2019-09-05
  https://access.redhat.com/errata/RHSA-2019:2587
• Red Hat Security Advisory RHSA-2019:3023 vom 2019-10-10
  https://access.redhat.com/errata/RHSA-2019:3023
• Red Hat Security Advisory RHSA-2019:3024 vom 2019-10-10
  https://access.redhat.com/errata/RHSA-2019:3024
• PoC Collection "awesome-cve-poc" vom 2019-11-05
  https://github.com/qazbnm456/awesome-cve-poc
• Red Hat Security Advisory RHSA-2020:1325 vom 2020-04-06
  https://access.redhat.com/errata/RHSA-2020:1325
• Red Hat Security Advisory RHSA-2020:2412 vom 2020-07-13
  https://access.redhat.com/errata/RHSA-2020:2412
• Red Hat Security Advisory RHSA-2020:3247 vom 2020-08-04
  https://access.redhat.com/errata/RHSA-2020:3247
• Red Hat Security Advisory RHSA-2020:3936 vom 2020-09-29
  https://access.redhat.com/errata/RHSA-2020:3936
• Red Hat Security Advisory RHSA-2020:4670 vom 2020-11-04
  https://access.redhat.com/errata/RHSA-2020:4670
• Red Hat Security Advisory RHSA-2020:4847 vom 2020-11-04
  https://access.redhat.com/errata/RHSA-2020:4847
• Red Hat Security Advisory RHSA-2020:5581 vom 2020-12-16
  https://access.redhat.com/errata/RHSA-2020:5581
• Red Hat Security Advisory RHSA-2020:5571 vom 2020-12-16
  https://access.redhat.com/errata/RHSA-2020:5571
• Red Hat Security Advisory RHSA-2022:7343 vom 2022-11-02
  https://access.redhat.com/errata/RHSA-2022:7343
• Red Hat Security Advisory RHSA-2022:8652 vom 2022-11-28
  https://access.redhat.com/errata/RHSA-2022:8652
• Red Hat Security Advisory RHSA-2022:8848 vom 2022-12-08
  https://access.redhat.com/errata/RHSA-2022:8848
• Red Hat Security Advisory RHSA-2022:8865 vom 2022-12-08
  https://access.redhat.com/errata/RHSA-2022:8865
• Amazon Linux Security Advisory ALAS2-2023-1905 vom 2023-01-23
  https://alas.aws.amazon.com/AL2/ALAS-2023-1905.html
• Red Hat Security Advisory RHSA-2023:5693 vom 2023-10-16
  https://access.redhat.com/errata/RHSA-2023:5693
• Debian Security Advisory DLA-1479 vom 2026-10-09
  https://security-tracker.debian.org/tracker/twitter-bootstrap3