WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Vendor redhat✕Product openshift container platform for ibm linuxone✕
Overview 5 matches · 4 in Waratek scope · 1 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
5matches 4in Waratek scope80.0% 1protected20.0% 0exploited0.0% 0CISA KEV0.0% 1public PoC20.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 1 20.0% Rule in development 0 0.0% Mitigation candidate 1 20.0% No exploit published 2 40.0% Outside Waratek scope 0 0.0% Not applicable 1 20.0% Withdrawn CVE 0 0.0%
Critical 1 20.0% High 2 40.0% Medium 2 40.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 20.0% partly blocked 0 0.0% not blocked 4 80.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 1 20.0% Forecast only 0 0.0% No public exploit 4 80.0%
split by peak 1 / month
Not applicable: 1No exploit published: 2Mitigation candidate: 1Protected by Waratek: 1 Medium: 2High: 2Critical: 1 not blocked: 4blocked by ARMR today: 1 No public exploit: 4Proof of concept only: 1
Mar 231 Not applicable1 Medium1 not blocked1 No public exploit1 Apr 230 May 230 Jun 230 Jul 231 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 Aug 231 Mitigation candidate1 Medium1 not blocked1 Proof of concept only1 Sep 231 No exploit published1 High1 not blocked1 No public exploit1 Oct 230 Nov 230 Dec 231 No exploit published1 High1 not blocked1 No public exploit1
Mar 23Apr 23May 23Jun 23Jul 23Aug 23Sep 23Oct 23Nov 23Dec 23
5 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-6563 High 2023-12-14 No exploit published No public exploit An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens (> 500,000 users with each having at least 2 saved sessions). If an attacker creates two or more user sessions and then open the "consents" tab of the admin User Interface, the UI attempts to load a huge number of offline client sessions leading to excessive memory and CPU consumption which could potentially crash the entire system.
CVE-2023-3223 High 2023-09-27 No exploit published No public exploit A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass the limit by setting the file name in the request to null.
CVE-2023-0264 Medium 2023-08-04 Mitigation candidate Proof of concept only A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to impersonate the victim and generate new session tokens. This issue could impact confidentiality, integrity, and availability.
CVE-2022-4361 Critical 2023-07-07 Protected by Waratek No public exploit Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providers. The vulnerability can allow an attacker to execute malicious scripts by setting the AssertionConsumerServiceURL value or the redirect_uri.
CVE-2023-0056 Medium 2023-03-23 Not applicable No public exploit An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. This issue could allow an authenticated remote attacker to run a specially crafted malicious server in an OpenShift cluster. The biggest impact is to availability.