Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-1689 State: PUBLISHED Published: 2020-10-16T20:31:38.564979Z Last Updated: 2024-09-17T01:31:50.083Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Juniper Networks Products: Junos OS Problem Types: CWE-400 Description: On Juniper Networks EX4300-MP Series, EX4600 Series and QFX5K Series deployed in a Virtual Chassis configuration, receipt of a stream of specific layer 2 frames can cause high CPU load, which could lead to traffic interruption. This issue does not occur when the device is deployed in Stand Alone configuration. The offending layer 2 frame packets can originate only from within the broadcast domain where the device is connected
n. The offending layer 2 frame packets can originate only from within the broadcast domain where the device is connected. This issue affects Juniper Networks Junos OS on EX4300-MP Series, EX4600 Series and QFX5K Series: 17.3 versions prior to 17.3R3-S9; 17.4 versions prior to 17.4R2-S11, 17.4R3-S2, 17.4R3-S3; 18.1 versions prior to 18.1R3-S11; 18.2 versions prior to 18.2R3-S5; 18.3 versions prior to 18.3R2-S4, 18.3R3-S3; 18.4 versions prior to 18.4R2-S5, 18.4R3-S4; 19.1 versions prior to 19.1R3-S2; 19.2 versions prior to 19.2R1-S5, 19.2R3; 19.3 versions prior to 19.3R2-S4, 19.3R3; 19.4 versions prior to 19.4R1-S3, 19.4R2-S1, 19.4R3; 20.1 versions prior to 20.1R1-S3, 20.1R2. Additional Analys
19.3R3; 19.4 versions prior to 19.4R1-S3, 19.4R2-S1, 19.4R3; 20.1 versions prior to 20.1R1-S3, 20.1R2. Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/JSA11086
CVE ID: CVE-2020-1690 State: PUBLISHED Published: 2021-06-07T19:41:14 Last Updated: 2024-08-04T06:46:29.798Z Vendors: n/a Products: openstack-selinux Problem Types: CWE-285 Description: An improper authorization flaw was discovered in openstack-selinux's applied policy where it does not prevent a non-root user in a container from privilege escalation. A non-root attacker in one or more Red Hat OpenStack (RHOSP) containers could send messages to the dbus. With access to the dbus, the attacker could start or stop services, possibly causing a denial of service. Versions before openstack-selinux 0.8.24 are affected. Additional Analyst Notes: - CVE Program Container: References: - https://bugzill
openstack-selinux 0.8.24 are affected. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1789640
CVE ID: CVE-2020-1691 State: PUBLISHED Published: 2022-08-05T15:21:45 Last Updated: 2024-08-04T06:46:30.525Z Vendors: n/a Products: Moodle Problem Types: CWE-79 Description: In Moodle 3.8, messages required extra sanitizing before updating the conversation overview, to prevent the risk of stored cross-site scripting. Additional Analyst Notes: - CVE Program Container: References: - https://moodle.org/mod/forum/discuss.php?d=395953
CVE ID: CVE-2020-1692 State: PUBLISHED Published: 2020-02-17T15:38:35 Last Updated: 2024-08-04T06:46:30.166Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: The Moodle Project Products: moodle Problem Types: CWE-352 Description: Moodle before version 3.7.2 is vulnerable to information exposure of service tokens for users enrolled in the same course. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1692
CVE ID: CVE-2020-1693 State: PUBLISHED Published: 2020-02-17T19:35:43 Last Updated: 2024-08-04T06:46:30.296Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: Red Hat Products: spacewalk Problem Types: CWE-611 Description: A flaw was found in Spacewalk up to version 2.9 where it was vulnerable to XML internal entity attacks via the /rpc/api endpoint. An unauthenticated remote attacker could use this flaw to retrieve the content of certain files and trigger a denial of service, or in certain circumstances, execute arbitrary code on the Spacewalk server. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CV
server. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1693 - https://github.com/spacewalkproject/spacewalk/commit/74e28ec61d916c42061ef4347121650a1c962b0c - https://zeroauth.ltd/blog/2020/02/18/proof-of-concept-exploit-for-cve-2020-1693-spacewalk/
CVE ID: CVE-2020-1694 State: PUBLISHED Published: 2020-09-16T18:03:14 Last Updated: 2024-08-04T06:46:29.917Z Vendors: n/a Products: keycloak Problem Types: CWE-183 Description: A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. This flaw results in some users having access to sensitive information outside of their permissions. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1790759
CVE ID: CVE-2020-1695 State: PUBLISHED Published: 2020-05-19T14:13:10 Last Updated: 2024-08-04T06:46:29.740Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Red Hat Products: resteasy Problem Types: CWE-20 Description: A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to unexpected behavior when the HTTP response is constructed. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/sh
response is constructed. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1695 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RX22C6I56BJUER76IIPYHGZIWBQIU3CQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IJDMT443YZWCBS5NS76XZ7TL3GK7BXHL/
CVE ID: CVE-2020-1696 State: PUBLISHED Published: 2020-03-20T13:58:49 Last Updated: 2024-08-04T06:46:30.878Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: [UNKNOWN] Products: pki-core Problem Types: CWE-79 Description: A flaw was found in the all pki-core 10.x.x versions, where Token Processing Service (TPS) where it did not properly sanitize Profile IDs, enabling a Stored Cross-Site Scripting (XSS) vulnerability when the profile ID is printed. An attacker with sufficient permissions could trick an authenticated victim into executing a specially crafted Javascript code. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redha
ecially crafted Javascript code. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1696
CVE ID: CVE-2020-1697 State: PUBLISHED Published: 2020-02-10T14:13:58 Last Updated: 2024-08-04T06:46:30.433Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Red Hat Products: keycloak Problem Types: CWE-79 Description: It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user could create URLs to trick users in other realms, and possibly conduct further attacks. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1697
CVE ID: CVE-2020-1698 State: PUBLISHED Published: 2020-05-11T13:00:18 Last Updated: 2024-08-04T06:46:29.965Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: Red Hat Products: keycloak Problem Types: CWE-200 Description: A flaw was found in keycloak in versions before 9.0.0. A logged exception in the HttpMethod class may leak the password given as parameter. The highest threat from this vulnerability is to data confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1698
CVE ID: CVE-2020-1699 State: PUBLISHED Published: 2020-04-21T15:27:07 Last Updated: 2024-08-04T06:46:30.457Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: The Ceph Project Products: ceph Problem Types: CWE-200 Description: A path traversal flaw was found in the Ceph dashboard implemented in upstream versions v14.2.5, v14.2.6, v15.0.0 of Ceph storage and has been fixed in versions 14.2.7 and 15.1.0. An unauthenticated attacker could use this flaw to cause information disclosure on the host machine running the Ceph dashboard. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1699
CVE ID: CVE-2020-1700 State: PUBLISHED Published: 2020-02-07T00:00:00 Last Updated: 2024-08-04T06:46:30.305Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: [UNKNOWN] Products: ceph Problem Types: CWE-400 Description: A flaw was found in the way the Ceph RGW Beast front-end handles unexpected disconnects. An authenticated attacker can abuse this flaw by making multiple disconnect attempts resulting in a permanent leak of a socket connection by radosgw. This flaw could lead to a denial of service condition by pile up of CLOSE_WAIT sockets, eventually leading to the exhaustion of available resources, preventing legitimate users from connecting to the system. A
ventually leading to the exhaustion of available resources, preventing legitimate users from connecting to the system. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1700 - http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00009.html - https://usn.ubuntu.com/4304-1/ - https://lists.debian.org/debian-lts-announce/2023/10/msg00034.html
CVE ID: CVE-2020-1701 State: PUBLISHED Published: 2021-05-27T19:45:04 Last Updated: 2024-08-04T06:46:29.878Z Vendors: n/a Products: virt-handler Problem Types: CWE-732 Description: A flaw was found in the KubeVirt main virt-handler versions before 0.26.0 regarding the access permissions of virt-handler. An attacker with access to create VMs could attach any secret within their namespace, allowing them to read the contents of that secret. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1792092
CVE ID: CVE-2020-1702 State: PUBLISHED Published: 2021-05-27T19:45:08 Last Updated: 2024-08-04T06:46:30.897Z Vendors: n/a Products: containers/image Problem Types: CWE-400 Description: A malicious container image can consume an unbounded amount of memory when being pulled to a container runtime host, such as Red Hat Enterprise Linux using podman, or OpenShift Container Platform. An attacker can use this flaw to trick a user, with privileges to pull container images, into crashing the process responsible for pulling the image. This flaw affects containers-image versions before 5.2.0. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1
re 5.2.0. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1792796
CVE ID: CVE-2020-1703 State: REJECTED Published: 2020-06-03T13:49:08 Last Updated: 2020-06-03T13:50:09 Description: No description available.
CVE ID: CVE-2020-1704 State: PUBLISHED Published: 2020-02-17T16:38:06 Last Updated: 2024-08-04T06:46:30.534Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: openshift-service-mesh/kiali-rhel7-operator Problem Types: CWE-266 Description: An insecure modification vulnerability in the /etc/passwd file was found in all versions of OpenShift ServiceMesh (maistra) before 1.0.8 in the openshift/istio-kialia-rhel7-operator-container. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id
privileges. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1704
CVE ID: CVE-2020-1705 State: PUBLISHED Published: 2020-03-19T15:14:36 Last Updated: 2024-08-04T06:46:29.711Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: openshift/template-service-broker-operator Problem Types: CWE-266 Description: A vulnerability was found in openshift/template-service-broker-operator in all 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the /etc/passwd file was found in the openshift/template-service-broker-operator. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges. Additional Analyst Notes: - CVE Program Container: References:
flaw to modify /etc/passwd and escalate their privileges. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1705
CVE ID: CVE-2020-1706 State: PUBLISHED Published: 2020-03-09T00:00:00 Last Updated: 2024-08-04T06:46:30.091Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: openshift/apb-tools-container Problem Types: CWE-732 Description: It has been found that in openshift-enterprise version 3.11 and openshift-enterprise versions 4.1 up to, including 4.3, multiple containers modify the permissions of /etc/passwd to make them modifiable by users other than root. An attacker with access to the running container can exploit this to modify /etc/passwd to add a user and escalate their privileges. This CVE is specific to the openshift/apb-tools-container. Additiona
passwd to add a user and escalate their privileges. This CVE is specific to the openshift/apb-tools-container. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1706
CVE ID: CVE-2020-1707 State: PUBLISHED Published: 2020-03-20T00:00:00 Last Updated: 2024-08-04T06:46:30.234Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: [UNKNOWN] Products: openshift/postgresql-apb Problem Types: CWE-732 Description: A vulnerability was found in all openshift/postgresql-apb 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the /etc/passwd file was found in the container openshift/postgresql-apb. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?i
privileges. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1707
CVE ID: CVE-2020-1708 State: PUBLISHED Published: 2020-02-07T20:37:26 Last Updated: 2024-08-04T06:46:30.230Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: openshift/mysql-apb Problem Types: CWE-266 Description: It has been found in openshift-enterprise version 3.11 and all openshift-enterprise versions from 4.1 to, including 4.3, that multiple containers modify the permissions of /etc/passwd to make them modifiable by users other than root. An attacker with access to the running container can exploit this to modify /etc/passwd to add a user and escalate their privileges. This CVE is specific to the openshift/mysql-apb. Additional Analyst Note
wd to add a user and escalate their privileges. This CVE is specific to the openshift/mysql-apb. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1708 - https://access.redhat.com/errata/RHSA-2020:0681 - https://access.redhat.com/errata/RHSA-2020:0617 - https://access.redhat.com/errata/RHSA-2020:0694
CVE ID: CVE-2020-1709 State: PUBLISHED Published: 2020-03-20T00:00:00 Last Updated: 2024-08-04T06:46:30.193Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: [UNKNOWN] Products: openshift/mediawiki Problem Types: CWE-732 Description: A vulnerability was found in all openshift/mediawiki 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the /etc/passwd file was found in the openshift/mediawiki. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1709
CVE ID: CVE-2020-1710 State: PUBLISHED Published: 2020-09-16T14:28:20 Last Updated: 2024-08-04T06:46:30.214Z Vendors: n/a Products: JBoss Enterprise Application Platform Problem Types: Improper Neutralization of CRLF Sequences in HTTP Headers Description: The issue appears to be that JBoss EAP 6.4.21 does not parse the field-name in accordance to RFC7230[1] as it returns a 200 instead of a 400. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1793970
CVE ID: CVE-2020-1711 State: PUBLISHED Published: 2020-02-11T19:42:48 Last Updated: 2024-08-04T06:46:30.807Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H) Vendors: Red Hat Products: QEMU Problem Types: CWE-122 Description: An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU versions 2.12.0 before 4.2.1 handled a response coming from an iSCSI server while checking the status of a Logical Address Block (LBA) in an iscsi_co_block_status() routine. A remote user could use this flaw to crash the QEMU process, resulting in a denial of service or potential execution of arbitrary code with privileges of the QEMU process on the host. A
lting in a denial of service or potential execution of arbitrary code with privileges of the QEMU process on the host. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1711 - https://lists.gnu.org/archive/html/qemu-devel/2020-01/msg05535.html - https://www.openwall.com/lists/oss-security/2020/01/23/3 - https://usn.ubuntu.com/4283-1/ - https://access.redhat.com/errata/RHSA-2020:0669 - https://access.redhat.com/errata/RHSA-2020:0773 - https://access.redhat.com/errata/RHSA-2020:0730 - https://access.redhat.com/errata/RHSA-2020:0731 - https://lists.debian.org/debian-lts-announce/2020/03/msg00017.html - http://lists.opensuse.org
m/errata/RHSA-2020:0731 - https://lists.debian.org/debian-lts-announce/2020/03/msg00017.html - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00007.html - https://security.gentoo.org/glsa/202005-02 - https://lists.debian.org/debian-lts-announce/2020/09/msg00013.html
CVE ID: CVE-2020-1712 State: PUBLISHED Published: 2020-03-31T16:44:29.000Z Last Updated: 2025-06-09T15:53:12.293Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: [UNKNOWN] Products: systemd Problem Types: CWE-416 Description: A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzil
dbus messages. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1712 - https://www.openwall.com/lists/oss-security/2020/02/05/1 - https://github.com/systemd/systemd/commit/ea0d0ede03c6f18dbc5036c5e9cccf97e415ccc2 - https://github.com/systemd/systemd/commit/1068447e6954dc6ce52f099ed174c442cb89ed54 - https://github.com/systemd/systemd/commit/637486261528e8aa3da9f26a4487dc254f4b7abb - https://github.com/systemd/systemd/commit/bc130b6858327b382b07b3985cf48e2aa9016b2d - https://lists.debian.org/debian-lts-announce/2022/06/msg00025.html
CVE ID: CVE-2020-1713 State: REJECTED Published: N/A Last Updated: 2023-01-19T00:00:00 Description: No description available.
CVE ID: CVE-2020-1714 State: PUBLISHED Published: 2020-05-13T18:25:56 Last Updated: 2024-08-04T06:46:30.830Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: keycloak Problem Types: CWE-20 Description: A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects, which would then get deserialized in a privileged context and potentially lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1714 - https://githu
Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1714 - https://github.com/keycloak/keycloak/pull/7053
CVE ID: CVE-2020-1715 State: REJECTED Published: N/A Last Updated: 2023-01-19T00:00:00 Description: No description available.
CVE ID: CVE-2020-1716 State: PUBLISHED Published: 2021-05-28T12:46:28 Last Updated: 2024-08-04T06:46:30.190Z Vendors: n/a Products: ceph-ansible Problem Types: CWE-798 Description: A flaw was found in the ceph-ansible playbook where it contained hardcoded passwords that were being used as default passwords while deploying Ceph services. Any authenticated attacker can abuse this flaw to brute-force Ceph deployments, and gain administrator access to Ceph clusters via the Ceph dashboard to initiate read, write, and delete Ceph clusters and also modify Ceph cluster configurations. Versions before ceph-ansible 6.0.0alpha1 are affected. Additional Analyst Notes: - CVE Program Container: References
ns. Versions before ceph-ansible 6.0.0alpha1 are affected. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1795592
CVE ID: CVE-2020-1717 State: PUBLISHED Published: 2021-02-11T15:27:07 Last Updated: 2024-08-04T06:46:29.996Z Vendors: n/a Products: keycloak Problem Types: CWE-209 Description: A flaw was found in Keycloak 7.0.1. A logged in user can do an account email enumeration attack. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1796281 - https://issues.jboss.org/browse/KEYCLOAK-12014
CVE ID: CVE-2020-1718 State: PUBLISHED Published: 2020-05-12T20:25:29 Last Updated: 2024-08-04T06:46:30.307Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H) Vendors: Red Hat Products: keycloak Problem Types: CWE-287 Description: A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0. This flaw allows an attacker to gain unauthorized access to the application. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1718
CVE ID: CVE-2020-1719 State: PUBLISHED Published: 2021-06-07T16:23:44 Last Updated: 2024-08-04T06:46:30.328Z Vendors: n/a Products: Wildfly Problem Types: CWE-270 Description: A flaw was found in wildfly. The EJBContext principle is not popped back after invoking another EJB using a different Security Domain. The highest threat from this vulnerability is to data confidentiality and integrity. Versions before wildfly 20.0.0.Final are affected. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1796617