Rhosemc (Redhat) - vulnerabilities (CVEs)

47 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2026-08-11. Vendor: Redhat.

CVEs of Rhosemc

CVE-2026-15563 - CVSS 7.4 (high), 2026-08-11: A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups…
CVE-2026-7507 - CVSS 7.5 (high), 2026-05-19: A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker could exploit this flaw by pre-creating an…
CVE-2026-7307 - CVSS 7.5 (high), 2026-05-19: A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language (SAML)…
CVE-2026-4786 - CVSS 7.1 (high), 2026-04-13: Mitgation of CVE-2026-4519 was incomplete. If the URL contained "%action" the mitigation could be bypassed for certain browser types the "webbrowser.open()"…
CVE-2026-6100 - CVSS 9.1 (critical), 2026-04-13: Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a…
CVE-2026-4634 - CVSS 7.5 (high), 2026-04-02: A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long…
CVE-2026-5121 - CVSS 9.8 (critical), 2026-03-30: A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker…
CVE-2026-4519 - CVSS 7.1 (high), 2026-03-20: The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects…
CVE-2026-4424 - CVSS 7.5 (high), 2026-03-19: A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS…
CVE-2026-27135 - CVSS 7.5 (high), 2026-03-18: nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data…
CVE-2026-2575 - CVSS 5.3 (medium), 2026-03-18: A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed…
CVE-2026-2092 - CVSS 7.7 (high), 2026-03-18: A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the…
CVE-2026-3497 - CVSS 8.2 (high), 2026-03-12: Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions. This vulnerability affects the GSSAPI patches added by various Linux…
CVE-2025-14831 - CVSS 5.3 (medium), 2026-02-09: A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via…
CVE-2025-9820 - CVSS 4 (medium), 2026-01-26: A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label…
CVE-2026-0603 - CVSS 8.3 (high), 2026-01-23: A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted,…
CVE-2025-12543 - CVSS 9.6 (critical), 2026-01-07: A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly…
CVE-2025-58712 - CVSS 6.4 (medium), 2025-10-22: A container privilege escalation flaw was found in certain AMQ Broker images. This issue stems from the /etc/passwd file being created with group-writable…
CVE-2025-9784 - CVSS 7.5 (high), 2025-09-02: A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to…
CVE-2025-6020 - CVSS 7.8 (high), 2025-06-17: A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their…
CVE-2025-4057 - CVSS 5.5 (medium), 2025-05-26: A flaw was found in ActiveMQ Artemis. The password generated by activemq-artemis-operator does not regenerate between separated CR dependencies.
CVE-2024-10234 - CVSS 7.3 (high), 2024-10-22: A vulnerability was found in Wildfly, where a user may perform Cross-site scripting in the Wildfly deployment system. This flaw allows an attacker or insider…
CVE-2024-8883 - CVSS 6.1 (medium), 2024-09-19: A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to…
CVE-2024-8698 - CVSS 7.7 (high), 2024-09-19: A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature…
CVE-2024-7341 - CVSS 7.1 (high), 2024-09-09: A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even…
CVE-2024-4629 - CVSS 6.5 (medium), 2024-09-03: A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating…
CVE-2024-5967 - CVSS 2.7 (low), 2024-06-18: A vulnerability was found in Keycloak. The LDAP testing endpoint allows changing the Connection URL independently without re-entering the currently…
CVE-2024-4540 - CVSS 7.5 (high), 2024-06-03: A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests (PAR). Client-provided parameters were found to be included in plain text in the…
CVE-2023-6544 - CVSS 5.4 (medium), 2024-04-25: A flaw was found in the Keycloak package. This issue occurs due to a permissive regular expression hardcoded for filtering which allows hosts to register a…
CVE-2023-6484 - CVSS 5.3 (medium), 2024-04-25: A log injection flaw was found in Keycloak. A text string may be injected through the authentication form when using the WebAuthn authentication mode. This…
CVE-2024-1249 - CVSS 7.4 (high), 2024-04-17: A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to…
CVE-2024-1132 - CVSS 8.1 (high), 2024-04-17: A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious…
CVE-2024-1635 - CVSS 7.5 (high), 2024-02-19: A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and…
CVE-2023-6291 - CVSS 7.1 (high), 2024-01-26: A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack…
CVE-2023-2585 - CVSS 8.1 (high), 2023-12-21: Keycloak's device authorization grant does not correctly validate the device code and client ID. An attacker client could abuse the missing validation to…
CVE-2023-6927 - CVSS 6.1 (medium), 2023-12-18: A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients using a wildcard in the JARM response mode…
CVE-2023-6134 - CVSS 5.4 (medium), 2023-12-14: A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an…
CVE-2023-6563 - CVSS 7.7 (high), 2023-12-14: An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens (>…
CVE-2023-2422 - CVSS 7.1 (high), 2023-10-04: A flaw was found in Keycloak. A Keycloak server configured to support mTLS authentication for OAuth/OpenID clients does not properly verify the client…
CVE-2023-4066 - CVSS 5.5 (medium), 2023-09-27: A flaw was found in Red Hat's AMQ Broker, which stores certain passwords in a secret security-properties-prop-module, defined in ActivemqArtemisSecurity CR;…
CVE-2023-4065 - CVSS 5.5 (medium), 2023-09-27: A flaw was found in Red Hat AMQ Broker Operator, where it displayed a password defined in ActiveMQArtemisAddress CR, shown in plain text in the Operator Log.…
CVE-2023-3223 - CVSS 7.5 (high), 2023-09-27: A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow…
CVE-2022-4039 - CVSS 9.8 (critical), 2023-09-22: A flaw was found in Red Hat Single Sign-On for OpenShift container images, which are configured with an unsecured management interface enabled. This flaw…
CVE-2022-3916 - CVSS 6.8 (medium), 2023-09-20: A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due…
CVE-2022-1438 - CVSS 6.4 (medium), 2023-09-20: A flaw was found in Keycloak. Under specific circumstances, HTML entities are not sanitized during user impersonation, resulting in a Cross-site scripting…
CVE-2023-4853 - CVSS 8.1 (high), 2023-09-20: A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in…
CVE-2023-1108 - CVSS 7.5 (high), 2023-09-14: A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the…