Red Hat Amq Broker 7

Vulnerabilities related to Red Hat Amq Broker 7 23

• High 8.0 Keycloak Admin CLIのkcadmで自己署名証明書を受け入れてしまう脆弱性 Keycloak Admin CLIのkcadmで、カスタムのtruststoreを指定したときに、ホスト名が一致すれば任意の自己署名証明書を受け入れてしまう脆弱性が見つかりました。ネットワーク上の攻撃者がKeycloakサーバーになりすまし、管理者の認証情報を盗んで不正な管理操作を行うおそれがあり、CVSSは8です。修正版の有無は公表されていないため、最新の情報を確認してください。 CVE-2026-96453 Nov 6, 02:15
• High 7.4 Keycloakの SAMLアダプターに認証を回避される脆弱性 Keycloakの SAMLアダプターで、署名付きアサーションの発行元が設定済みのIDプロバイダーと一致するかの確認が不十分です。同じ署名鍵を共有する複数のIDプロバイダーがある場合、そのうちの一つを管理する攻撃者が、任意のユーザーとしてアプリケーションにログインできるおそれがあります。CVSSは7.4です。修正版の情報は確認できていないため、最新の情報を確認してください。 CVE-2026-93998 Nov 6, 02:15
• High 8.2 Vulnerability in Apache CVE-2026-101292 Sep 28, 22:17
• Medium 6.5 A flaw was found in Netty's `netty-codec-http` component. A remote attacker could exploit this... Vulnerability reported (CVE-2026-93574). Risk of unauthorized operations or information disclosure. CVE-2026-93574 Sep 19, 06:18
• Medium 6.5 Vulnerability in Netty's HTTP/1 decoder CVE-2026-93562 Sep 19, 06:18
• Medium 6.5 Vulnerability in Netty's HTTP/2 stack CVE-2026-93579 Sep 19, 02:17
• Medium 6.5 Netty split Transfer-Encoding fields bypass final-chunked validation and enable request smuggling Vulnerability reported (CVE-2026-93573). Risk of unauthorized operations or information disclosure. CVE-2026-93573 Sep 19, 00:17
• High 8.2 HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request... Vulnerability reported (CVE-2026-93569). Data can be tampered with by attackers. CVE-2026-93569 Sep 19, 00:17
• High 7.5 HTTP/2 and HTTP/3 Extended CONNECT requests are downgraded as regular CONNECT requests Vulnerability reported (CVE-2026-93568). Data can be tampered with by attackers. CVE-2026-93568 Sep 19, 00:17
• High 7.5 HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled ... Vulnerability reported (CVE-2026-93567). Data can be tampered with by attackers. CVE-2026-93567 Sep 19, 00:17
• Medium 6.5 ### Summary Netty skips strict chunk size line validation when the line has no chunk extension (`... Vulnerability reported (CVE-2026-93566). Risk of unauthorized operations or information disclosure. Exploitable via GET /smuggled. CVE-2026-93566 Sep 19, 00:17
• High 7.5 ### Summary `RtspMethods.valueOf()` silently strips trailing control bytes (any character with... Vulnerability reported (CVE-2026-93565). Data can be tampered with by attackers. Exploitable via RtspDecoder. CVE-2026-93565 Sep 19, 00:17
• High 7.5 HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak (incomplete fix of PR #16881) Vulnerability reported (CVE-2026-93564). Risk of unauthorized operations or information disclosure. CVE-2026-93564 Sep 19, 00:17
• High 7.5 Unbounded Per-Connection Queue Growth in WebSocketServerExtensionHandler Leads to Denial of Service Vulnerability reported (CVE-2026-93558). Risk of unauthorized operations or information disclosure. CVE-2026-93558 Sep 19, 00:17
• Medium 5.3 Vulnerability in Netty's HTTP/2 HpackEncoder CVE-2026-93492 Sep 18, 22:18
• High 7.5 Vulnerability in Netty's HttpServerCodec CVE-2026-93491 Sep 18, 22:18
• High 7.5 Vulnerability in Netty CVE-2026-93488 Sep 18, 21:17
• High 8.3 SQL Injection in org.hibernate:hibernate-core CVE-2026-0603 Jan 23, 16:15
• Medium 6.0 Cross-Site Scripting (XSS) in Keycloak Cross-site scripting in Keycloak (CVE-2023-6717). Confidential information can be exposed externally. CVE-2023-6717 Apr 26, 2024
• High 7.4 Vulnerability in checkLoginIframe CVE-2024-1249 Apr 17, 2024
• High 8.1 Path Traversal in Keycloak CVE-2024-1132 Apr 17, 2024
• Medium 5.4 A vulnerability in the Eclipse Vert.x toolkit causes a memory leak in TCP servers configured with TLS and SNI support… Vulnerability reported (CVE-2024-1300). Risk of unauthorized operations or information disclosure. CVE-2024-1300 Apr 2, 2024
• Medium 6.5 Vulnerability in Eclipse Vert.x toolkit CVE-2024-1023 Mar 27, 2024