Vulnerabilities > Redhat > Keycloak > High
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-09-10 | CVE-2023-6841 | Unspecified vulnerability in Redhat Keycloak and Single Sign-On A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with long attribute values. | 7.5 |
| 2024-09-09 | CVE-2024-7341 | Session Fixation vulnerability in Redhat Keycloak A session fixation issue was discovered in the SAML adapters provided by Keycloak. | 7.1 |
| 2024-01-26 | CVE-2023-6291 | Open Redirect vulnerability in Redhat products A flaw was found in the redirect_uri validation logic in Keycloak. | 7.1 |
| 2023-12-14 | CVE-2023-6563 | Allocation of Resources Without Limits or Throttling vulnerability in Redhat products An unconstrained memory consumption vulnerability was discovered in Keycloak. | 7.7 |
| 2023-10-04 | CVE-2023-2422 | Improper Certificate Validation vulnerability in Redhat products A flaw was found in Keycloak. | 7.1 |
| 2023-09-12 | CVE-2023-4918 | Cleartext Transmission of Sensitive Information vulnerability in Redhat Keycloak 22.0.2 A flaw was found in the Keycloak package, more specifically org.keycloak.userprofile. | 8.8 |
| 2022-08-26 | CVE-2021-3632 | Improper Authentication vulnerability in Redhat Keycloak and Single Sign-On A flaw was found in Keycloak. | 7.5 |
| 2022-08-22 | CVE-2021-3513 | Information Exposure Through an Error Message vulnerability in Redhat Keycloak A flaw was found in keycloak where a brute force attack is possible even when the permanent lockout feature is enabled. | 7.5 |
| 2022-08-05 | CVE-2022-2668 | Unspecified vulnerability in Redhat Keycloak and Single Sign-On An issue was discovered in Keycloak that allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOAD_SCRIPTS feature is disabled | 7.2 |
| 2022-04-01 | CVE-2021-3461 | Insufficient Session Expiration vulnerability in Redhat Keycloak and Single Sign-On A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type is set to Attribute [Name]. | 7.1 |