Search for packages
| purl | pkg:maven/org.keycloak/keycloak-model-infinispan@3.4.0.CR1 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-7qnt-1wwt-aaap
Aliases: CVE-2022-3916 GHSA-97g8-xfvw-q4hg GMS-2022-8406 |
Keycloak vulnerable to session takeover with OIDC offline refreshtokens |
Affected by 1 other vulnerability. |
|
VCID-cevr-hgfk-aaae
Aliases: CVE-2021-3637 GHSA-2vp8-jv5v-6qh6 |
Allocation of resources without limits or throttling in keycloak-model-infinispan |
Affected by 2 other vulnerabilities. |
|
VCID-kfzc-yxas-aaad
Aliases: CVE-2023-6291 GHSA-mpwq-j3xf-7m5w |
The redirect_uri validation logic allows for bypassing explicitly allowed hosts that would otherwise be restricted |
Affected by 0 other vulnerabilities. |
|
VCID-wyud-q1dq-aaab
Aliases: CVE-2019-14832 GHSA-8prc-58j4-m55q |
Incorrect Authorization A flaw was found in the Keycloak REST API, where it would permit user access from a realm the user, was not configured. An authenticated attacker with knowledge of a user id could use this flaw to access unauthorized information or to carry out further attacks. |
Affected by 3 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||