Export limit exceeded: 203743 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 203743 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (203743 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-123547 | 1 Openidentityplatform | 1 Openam | 2026-11-08 | 4.7 Medium |
| OpenAM before 16.1.4 contains an open redirect vulnerability that allows attackers to redirect users to external sites because RelayState is unchecked when no relayStateUrlList is configured. Attackers can craft single sign-on links with a malicious RelayState to send users from the trusted OpenAM origin to phishing sites and bypass URL filters. | ||||
| CVE-2026-123546 | 1 Openidentityplatform | 1 Openam | 2026-11-08 | 6.1 Medium |
| OpenAM before 16.1.4 contains an open redirect and cross-site scripting vulnerability that allows remote attackers to control post-login and logout destinations via the goto and gotoOnFail parameters. Attackers can craft OpenAM login or logout links that redirect victims to phishing sites or run script in the XUI to steal session cookies. | ||||
| CVE-2026-123545 | 1 Openidentityplatform | 1 Openam | 2026-11-08 | 7.1 High |
| OpenAM from 14.5.1 before 16.1.4 contains a cross-site request forgery vulnerability in the OAuth 2.0 device authorization flow that allows attackers to approve device codes when consent is skipped for implied-consent clients. Attackers can start a device authorization and lure a logged-in user to a crafted page, obtaining access and ID tokens to call APIs as that user. | ||||
| CVE-2026-123544 | 1 Openidentityplatform | 1 Openam | 2026-11-08 | 6.8 Medium |
| OpenAM before 16.1.4 and its client SDK fail to sufficiently validate responses on the internal server-to-server SOAP channel, allowing network-positioned attackers to affect integrity and availability. Attackers who intercept unencrypted traffic or control a site server can crash receiving processes, tamper with writable files, and possibly execute code. | ||||
| CVE-2026-123543 | 1 Openidentityplatform | 1 Openam | 2026-11-08 | 7.5 High |
| OpenAM before 16.1.4 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server resources by sending serialized Java data without size or structure limits. Attackers can send small crafted requests to remote SDK endpoints, classic login pages, or the administration console to block authentication, session validation and policy decisions. | ||||
| CVE-2026-123542 | 1 Openidentityplatform | 1 Openam | 2026-11-08 | 6.8 Medium |
| OpenAM before 16.1.4 fails to enforce PKCE in the OAuth 2.0 device authorization flow, never validating the code verifier when device codes are exchanged for tokens. Attackers who obtain an approved device code from client logs or shared device storage can redeem it for access and ID tokens to impersonate the user. | ||||
| CVE-2026-123541 | 1 Openidentityplatform | 1 Openam | 2026-11-08 | 4.7 Medium |
| OpenAM before 16.1.4 contains an open redirect vulnerability that allows remote attackers to redirect users after SAML 1.x single sign-on by exploiting loose trusted-partner destination matching. Attackers can craft links to /SAMLAwareServlet or /SAMLPOSTProfileServlet with a destination host resembling a trusted partner to send authenticated users to attacker-controlled phishing sites. | ||||
| CVE-2026-123540 | 1 Openidentityplatform | 1 Openam | 2026-11-08 | 2 Low |
| OpenAM before 16.1.4 contains an incomplete output encoding vulnerability that allows a SAML 1.x identity provider to alter attribute values by injecting unencoded content into the service provider auto-submitted form. Attackers controlling a trusted identity provider can craft assertion attribute names or values that reach the target application in modified form, undermining the integrity of received attributes. | ||||
| CVE-2026-123539 | 1 Openidentityplatform | 1 Openam | 2026-11-08 | 4.8 Medium |
| OpenAM before 16.1.4 contains a stored cross-site scripting vulnerability that allows privileged attackers to inject script by placing markup in a user's display name. When the victim reaches the OAuth 2.0 / OpenID Connect consent page, the unencoded name executes script that can steal the OpenAM session cookie to impersonate the user. | ||||
| CVE-2026-123538 | 1 Openidentityplatform | 1 Openam | 2026-11-08 | 6.6 Medium |
| OpenAM before 16.1.4 does not verify that a signed SAML 1.x assertion or response was signed by the partner named as its issuer, accepting a signature from any certificate in OpenAM's keystore. An attacker holding such a private key, such as a trusted SAML 1.x partner, can forge assertions claiming another partner's issuer and sign in as that partner's users, including privileged ones. | ||||
| CVE-2026-123537 | 1 Openidentityplatform | 1 Openam | 2026-11-08 | 5 Medium |
| OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows parties registering UMA resource sets to trigger internal requests through unvalidated scope description URLs. Attackers can register resource sets with scope URLs pointing to internal hosts or cloud metadata endpoints, which OpenAM fetches when sending pending-request notification emails, enabling internal network probing. | ||||
| CVE-2026-123536 | 1 Openidentityplatform | 1 Openam | 2026-11-08 | 4.1 Medium |
| OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows administrators, including delegated realm administrators, to make the server fetch arbitrary URLs through federation configuration wizard metadata URLs. Attackers can enter metadata or OpenID Connect discovery URLs pointing to internal hosts or cloud metadata endpoints to probe the internal network and read partial responses. | ||||
| CVE-2026-123535 | 1 Tornadoweb | 1 Tornado | 2026-11-08 | 4.2 Medium |
| Tornado before 6.6 does not validate the max_age argument of RequestHandler.set_cookie (also called by set_signed_cookie, set_secure_cookie, and clear_cookie), allowing injection of additional Set-Cookie attributes. When an application passes attacker-influenced input as max_age, an attacker can embed attributes such as Domain, Path, or Secure to widen the cookie's scope to parent paths or other subdomains. | ||||
| CVE-2026-123534 | 1 Tornadoweb | 1 Tornado | 2026-11-08 | 6.5 Medium |
| Tornado before 6.6 contains a path traversal vulnerability in RequestHandler.static_url() and get_version() that allows attackers to hash files outside static_path using ../ sequences. Attackers controlling input passed to static_url() can obtain SHA-512 hashes of readable files to confirm their existence, or reference /dev/zero to block the event loop indefinitely. | ||||
| CVE-2026-123533 | 1 Gitoxidelabs | 1 Gitoxide | 2026-11-08 | 5.5 Medium |
| gix-commitgraph before 0.42.0, as used in gitoxide before 0.61.0, contains a denial of service vulnerability because its commit-graph parser does not validate parent graph positions against the declared commit count or check the EDGE chunk length for 4-byte alignment. Attackers can supply a repository containing a crafted .git/objects/info/commit-graph file to trigger panics that abort gix merge-base, gix blame, and applications embedding gix. | ||||
| CVE-2026-123532 | 1 Gitoxidelabs | 1 Gitoxide | 2026-11-08 | 6.5 Medium |
| gix-fs in gitoxide before 0.24.1 contains a credential disclosure vulnerability that allows remote attackers to capture NTLM credentials by supplying UNC symlink targets in a crafted repository. When a victim checks out the repository on Windows with symlinks enabled, gix_fs::symlink::create calls is_dir() on the UNC target, triggering SMB authentication that leaks the username, domain, and NTLMv2 hash. | ||||
| CVE-2026-123531 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 8.8 High |
| Vikunja from 1.0.0 before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to bypass service.maxitemsperpage by sending page=0 to /api/v1 list endpoints. Attackers can self-register and repeatedly request page=0 to force unbounded SQL queries, memory materialisation, and per-row query fan-out, degrading availability for other users. | ||||
| CVE-2026-123530 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 5.9 Medium |
| Vikunja before 2.7.1 contains a missing authentication vulnerability that allows attackers holding a stolen session to enroll and enable TOTP without the account password. Attackers can call the TOTP enroll and enable endpoints with their own secret to lock the owner out, persisting even after password reset. | ||||
| CVE-2026-123529 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 4.6 Medium |
| Vikunja before 2.7.1 contains a stored CSS injection vulnerability that allows authenticated users with project write access to inject arbitrary CSS via unsanitized table-cell data-background-color attributes. Attackers can store crafted task descriptions or comments to render full-viewport phishing overlays or force zero-click outbound background-image requests that deanonymize viewers. | ||||
| CVE-2026-123528 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 6.8 Medium |
| Vikunja before 2.7.1 contains an insufficient session expiration vulnerability that allows holders of revoked access tokens to keep authenticating because SetupTokenMiddleware skips session and account-status checks. Attackers with a stolen token can, after logout, password reset, or account disabling, mint OAuth sessions via /oauth/authorize or tk_ API tokens for persistent access. | ||||