Keycloak (Unknown) - vulnerabilities (CVEs)

6 CVEs, 0 in the last 30 days, 3 known versions, newest CVE from 2020-06-22. Vendor: Unknown.

CVEs of Keycloak

• CVE-2020-1727 - CVSS 6.4 (medium), 2020-06-22: A vulnerability was found in Keycloak before 9.0.2, where every Authorization URL that points to an IDP server lacks proper input validation as it allows a…
• CVE-2019-10170 - CVSS 7.2 (high), 2020-05-08: A flaw was found in the Keycloak admin console, where the realm management interface permits a script to be set via the policy. This flaw allows an attacker…
• CVE-2019-10169 - CVSS 7.2 (high), 2020-05-08: A flaw was found in Keycloak’s user-managed access interface, where it would permit a script to be set in the UMA policy. This flaw allows an authenticated…
• CVE-2020-1728 - CVSS 5.4 (medium), 2020-04-06: A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing general HTTP…
• CVE-2018-14637 - CVSS 8.1 (high), 2018-11-30: The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions. An attacker can exploit this…
• CVE-2018-10912 - CVSS 4.9 (medium), 2018-07-23: keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired…