Connected evidence
Follow a shared identifier, source page or planning group across source records. Dates show chronology; a connection does not establish cause, a shared rollout or applicability to your environment.
Saved searches 0
Keep up to eight named searches. Saved in this browser. Filters are also shareable in the page address.
Threads
Related changes across sources- Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuer Affected-version evidence changed3 linked entries across history · in Security Follow evidence and connection reasons
- Keycloak-services: keycloak-services: stateless token preferred_username fallback enables identity rebinding Affected-version evidence changed3 linked entries across history · in Security Follow evidence and connection reasons
- Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates Affected-version evidence changed3 linked entries across history · in Security Follow evidence and connection reasons
- Keycloak-services: keycloak-services: indefinite access token renewal via standard token exchange v2 Affected-version evidence changed3 linked entries across history · in Security Follow evidence and connection reasons
- Keycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging realm_access.roles Affected-version evidence changed3 linked entries across history · in Security Follow evidence and connection reasons
- Keycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokens Affected-version evidence changed3 linked entries across history · in Security Follow evidence and connection reasons
- Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeover Newly collected advisory3 linked entries across history · in Security Follow evidence and connection reasons
- Keycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority Affected-version evidence changed3 linked entries across history · in Security Follow evidence and connection reasons
- Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitization Newly collected advisory3 linked entries across history · in Security Follow evidence and connection reasons
- io_uring/io-wq: don't lose the signal that ends work Affected-version evidence changed3 linked entries across history · in Security Follow evidence and connection reasons
- io_uring/wait: don't spin on a stuck overflow list Affected-version evidence changed3 linked entries across history · in Security Follow evidence and connection reasons
- io_uring/cmd: don't leave list poison in ->hash_node Affected-version evidence changed3 linked entries across history · in Security Follow evidence and connection reasons
- io_uring/waitid: own the request before clearing ->head Affected-version evidence changed3 linked entries across history · in Security Follow evidence and connection reasons
- io_uring/cancel: rearm local work wake up before sleep Affected-version evidence changed3 linked entries across history · in Security Follow evidence and connection reasons
- io_uring: don't flood a cancelling task with task_work Affected-version evidence changed3 linked entries across history · in Security Follow evidence and connection reasons
- io_uring/io-wq: don't hide a link from cancellations Affected-version evidence changed3 linked entries across history · in Security Follow evidence and connection reasons
- Echo: CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method Newly collected advisory: Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method in github.com/labstack/echo6 linked entries across history · in Security Follow evidence and connection reasons
- Echo: middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path Newly collected advisory: URL-encoded path bypasses route/group middleware guarding a statically-served path in github.com/labstack/echo6 linked entries across history · in Security Follow evidence and connection reasons
- Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default Newly collected advisory: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default in github.com/labstack/echo6 linked entries across history · in Security Follow evidence and connection reasons
- Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob Newly collected advisory: Cross-Site Scripting (XSS) via unsanitized JSONP callback in github.com/labstack/echo6 linked entries across history · in Security Follow evidence and connection reasons
- Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration Newly collected advisory: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration in github.com/labstack/echo6 linked entries across history · in Security Follow evidence and connection reasons
- Echo static file middleware route protection bypass via encoded dot-dot traversal Newly collected advisory: Echo static file middleware route protection bypass via encoded dot-dot traversal in github.com/labstack/echo6 linked entries across history · in Security Follow evidence and connection reasons
- Echo: Static Middleware Double-Unescape Path Traversal Newly collected advisory: Echo has a Static Middleware Double-Unescape Path Traversal in github.com/labstack/echo6 linked entries across history · in Security Follow evidence and connection reasons
- Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI Newly collected advisory: Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI in github.com/labstack/echo6 linked entries across history · in Security Follow evidence and connection reasons
- Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers Newly collected advisory: Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers in github.com/labstack/echo6 linked entries across history · in Security Follow evidence and connection reasons
- Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto Newly collected advisory: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto in github.com/labstack/echo6 linked entries across history · in Security Follow evidence and connection reasons
- Atlantis: OS command injection through PR-controlled Terraform workspace enables RCE during plan Newly collected advisory: OS command injection through PR-controlled Terraform workspace enables RCE during plan in github.com/runatlantis/atlantis5 linked entries across history · in Security Follow evidence and connection reasons
- Neko: Authorization bypass in legacy WebRTC input handling Newly collected advisory: Neko: Authorization bypass in legacy WebRTC input handling in github.com/m1k1o/neko/server5 linked entries across history · in Security Follow evidence and connection reasons
- FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directory Newly collected advisory: FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory in github.com/gtsteffaniak/filebrowser/backend5 linked entries across history · in Security Follow evidence and connection reasons
- CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values Newly collected advisory: CTFer.io's CTFd Terraform Provider allows a local or remote attacker to read team passwords in state as non sensitive values in github.com/ctfer-io/terraform-provider-ctfd5 linked entries across history · in Security Follow evidence and connection reasons