Vulnerabilities > Redhat > Single Sign ON
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2019-03-21 | CVE-2018-12022 | Deserialization of Untrusted Data vulnerability in multiple products An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. | 7.5 |
| 2018-11-13 | CVE-2018-14657 | Improper Restriction of Excessive Authentication Attempts vulnerability in Redhat Keycloak and Single Sign-On A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. | 8.1 |
| 2018-11-13 | CVE-2018-14655 | Cross-site Scripting vulnerability in Redhat Keycloak and Single Sign-On A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. | 3.5 |
| 2018-08-01 | CVE-2018-10894 | Improper Certificate Validation vulnerability in Redhat Keycloak and Single Sign-On It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates. | 5.5 |
| 2018-07-23 | CVE-2018-10912 | Infinite Loop vulnerability in multiple products keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. | 4.0 |
| 2018-03-12 | CVE-2017-2585 | Information Exposure vulnerability in Redhat Keycloak and Single Sign ON Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks. | 4.3 |
| 2018-03-12 | CVE-2016-8629 | Permissions, Privileges, and Access Controls vulnerability in Redhat Keycloak and Single Sign ON Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. | 5.5 |
| 2017-10-26 | CVE-2017-12159 | Insufficient Session Expiration vulnerability in multiple products It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. | 5.0 |
| 2017-10-26 | CVE-2017-12158 | Cross-site Scripting vulnerability in multiple products It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. | 3.5 |