oak-core CVEs | Waratek

VRT Sign in

Look up CVE IDs Status Exploitation Severity

Reset

Overview 3 matches · 0 protected · 1 exploited · 0 CISA KEV · 1 EPSS ≥ 0.5

3matches 0protected0.0% 1exploited33.3% 0CISA KEV0.0% 1EPSS ≥ 0.533.3%

Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 3 100.0% No exploit published 0 0.0%

Critical 0 0.0% High 0 0.0% Medium 3 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 3 100.0% not established 0 0.0% unrecorded 0 0.0%

Exploited 1 33.3% Working exploit published 2 66.7% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%

split by StatusSeverityProtectionExploit maturity peak 1 / month

Dec 201 Mitigation candidate1 Medium1 not blocked1 Exploited1 Jan 210 Feb 210 Mar 211 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 Apr 210 May 210 Jun 210 Jul 210 Aug 210 Sep 210 Oct 210 Nov 210 Dec 210 Jan 220 Feb 220 Mar 221 Mitigation candidate1 Medium1 not blocked1 Working exploit published1

Jan 21Mar 21May 21Jul 21Sep 21Nov 21Jan 22Mar 22

3 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2021-20323	Medium	2022-03-25	Mitigation candidate	Working exploit published	A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak.
CVE-2020-27838	Medium	2021-03-08	Mitigation candidate	Working exploit published	A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients (like client secret) without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL later. The highest threat from this vulnerability is to data confidentiality.
CVE-2020-10770	Medium	2020-12-15	Mitigation candidate	Exploited	A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter request_uri. This flaw allows an attacker to use this parameter to execute a Server-side request forgery (SSRF) attack.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2021-20323

Medium

2022-03-25

Mitigation candidate

Working exploit published

A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak.

CVE-2020-27838

Medium

2021-03-08

Mitigation candidate

Working exploit published

A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients (like client secret) without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL later. The highest threat from this vulnerability is to data confidentiality.

CVE-2020-10770

Medium

2020-12-15

Mitigation candidate

Exploited

A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter request_uri. This flaw allows an attacker to use this parameter to execute a Server-side request forgery (SSRF) attack.