openshift serverless 1.33 güvenlik açıkları (CVE)

openshift serverless 1.33 için yayımlanan CVE kayıtları, en yenisi üstte. Yeni bir açık çıktığında e-posta almak için takip edin.

3 sonuç
6.0Orta
CVE-2023-6717

Keycloak: xss via assertion consumer service url in saml post-binding flow

keycloak; Red Hat Red Hat AMQ Broker 7; Red Hat Red Hat build of Keycloak 22; Red Hat Red Hat build of Keycloak 22.0.10

A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs (ACS), posing a Cross-Site Scripting (XSS) risk. This issue may allow a malici…

7.4Yüksek
CVE-2024-1249

Keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddos

keycloak; Red Hat Red Hat AMQ Broker 7; Red Hat Red Hat build of Keycloak 22; Red Hat Red Hat build of Keycloak 22.0.10

A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in seconds using simple code, significantly impacting the applicati…

7.0Yüksek
CVE-2024-2700

Quarkus-core: leak of local configuration properties into quarkus applications

quarkus-core; Red Hat HawtIO 4.0.0 for Red Hat build of Apache Camel 4; Red Hat Red Hat AMQ Streams 2.7.0; Red Hat Red Hat build of Apicurio Registry 2.6.1 GA

A vulnerability was found in the quarkus-core component. Quarkus captures local environment variables from the Quarkus namespace during the application's build, therefore, running the resulting application inherits the values captured at build time. Some loca…