ory kayıtları
ory üreticisine ait 14 yayımlanmış kayıt.
Araştırmacı profili
- KEV’e giren
- 0 · %0
- Silahlaştırılmış
- 0 · %0
- Pre-auth RCE
- 0
- Düzeltme kaydı olan
- %92,9
- Yayından KEV’e ortanca
- KEV’e giren kayıt yok
Tekrar eden sınıflar
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')3
- CWE-20 Improper Input Validation2
- CWE-287 Improper Authentication1
- CWE-294 Authentication Bypass by Capture-replay1
- CWE-305 Authentication Bypass by Primary Weakness1
- CWE-755 Improper Handling of Exceptional Conditions1
Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.
CWETüm kayıtlar
14 kayıt| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
40Planlayın | CVE-2026-33494İstismar yok | Ory Oathkeeper has a path traversal authorization bypassory · oathkeeper · CWE-23 | Kritik10,0 | — | %0,6 | 26 Mar 2026 |
35İzleyin | CVE-2026-33506İstismar yok | DOM-Based XSS in Ory Polis Login Pageory · polis · CWE-87 | Yüksek8,8 | — | %0,4 | 26 Mar 2026 |
32İzleyin | CVE-2020-15223İstismar yok | Ignored storage errors on token revokation in ORY Fositeory · fosite · CWE-755 | Yüksek8,0 | — | %1,6 | 24 Eyl 2020 |
32İzleyin | CVE-2020-15222İstismar yok | Replay of private_key_jwt possible in ORY Fositeory · fosite · CWE-287 | Yüksek8,1 | — | %0,9 | 24 Eyl 2020 |
32İzleyin | CVE-2026-33496İstismar yok | Ory Oathkeeper has an authentication bypass by cache key confusionory · oathkeeper · CWE-305 | Yüksek8,1 | — | %0,5 | 26 Mar 2026 |
30İzleyin | CVE-2021-32701İstismar yok | Possible bypass of token claim validation when OAuth2 Introspection caching is enabledory · oathkeeper · CWE-863 | Yüksek7,5 | — | %1,6 | 22 Haz 2021 |
28İzleyin | CVE-2026-33504İstismar yok | Ory Hydra has a SQL injection via forged pagination tokensory · hydra · CWE-89 | Yüksek7,2 | — | %0,4 | 26 Mar 2026 |
28İzleyin | CVE-2026-33503İstismar yok | Ory Kratos has a SQL injection via forged pagination tokensory · kratos · CWE-89 | Yüksek7,2 | — | %0,3 | 26 Mar 2026 |
28İzleyin | CVE-2026-33505İstismar yok | Ory Keto has a SQL injection via forged pagination tokensory · keto · CWE-89 | Yüksek7,2 | — | %0,3 | 26 Mar 2026 |
26İzleyin | CVE-2026-33495İstismar yok | Ory Oathkeeper has an authentication bypass by usage of untrusted headerory · oathkeeper · CWE-862 | Orta6,5 | — | %0,3 | 26 Mar 2026 |
24İzleyin | CVE-2019-8400İstismar yok | ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error error_hint parameter.ory · hydra · CWE-79 | Orta6,1 | — | %1,3 | 17 Şub 2019 |
21İzleyin | CVE-2020-5300İstismar yok | Disallow replay of `private_key_jwt` by blacklisting JTIs in Hydraory · hydra · CWE-294 | Orta5,3 | — | %1,0 | 6 Nis 2020 |
19İzleyin | CVE-2020-15234İstismar yok | Redirect URL matching ignores character casingory · fosite · CWE-20 | Orta4,8 | — | %0,8 | 2 Eki 2020 |
19İzleyin | CVE-2020-15233İstismar yok | OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addressesory · fosite · CWE-20 | Orta4,8 | — | %0,8 | 2 Eki 2020 |
- CVE-2026-3349440Planlayın
Ory Oathkeeper has a path traversal authorization bypass
KritikCVSS 10,0İstismar yokEPSS %1ory · oathkeeper26 Mar 2026
- CVE-2026-3350635İzleyin
DOM-Based XSS in Ory Polis Login Page
YüksekCVSS 8,8İstismar yokEPSS %0ory · polis26 Mar 2026
- CVE-2020-1522332İzleyin
Ignored storage errors on token revokation in ORY Fosite
YüksekCVSS 8,0İstismar yokEPSS %2ory · fosite24 Eyl 2020
- CVE-2020-1522232İzleyin
Replay of private_key_jwt possible in ORY Fosite
YüksekCVSS 8,1İstismar yokEPSS %1ory · fosite24 Eyl 2020
- CVE-2026-3349632İzleyin
Ory Oathkeeper has an authentication bypass by cache key confusion
YüksekCVSS 8,1İstismar yokEPSS %1ory · oathkeeper26 Mar 2026
- CVE-2021-3270130İzleyin
Possible bypass of token claim validation when OAuth2 Introspection caching is enabled
YüksekCVSS 7,5İstismar yokEPSS %2ory · oathkeeper22 Haz 2021
- CVE-2026-3350428İzleyin
Ory Hydra has a SQL injection via forged pagination tokens
YüksekCVSS 7,2İstismar yokEPSS %0ory · hydra26 Mar 2026
- CVE-2026-3350328İzleyin
Ory Kratos has a SQL injection via forged pagination tokens
YüksekCVSS 7,2İstismar yokEPSS %0ory · kratos26 Mar 2026
- CVE-2026-3350528İzleyin
Ory Keto has a SQL injection via forged pagination tokens
YüksekCVSS 7,2İstismar yokEPSS %0ory · keto26 Mar 2026
- CVE-2026-3349526İzleyin
Ory Oathkeeper has an authentication bypass by usage of untrusted header
OrtaCVSS 6,5İstismar yokEPSS %0ory · oathkeeper26 Mar 2026
- CVE-2019-840024İzleyin
ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error error_hint parameter.
OrtaCVSS 6,1İstismar yokEPSS %1ory · hydra17 Şub 2019
- CVE-2020-530021İzleyin
Disallow replay of `private_key_jwt` by blacklisting JTIs in Hydra
OrtaCVSS 5,3İstismar yokEPSS %1ory · hydra6 Nis 2020
- CVE-2020-1523419İzleyin
Redirect URL matching ignores character casing
OrtaCVSS 4,8İstismar yokEPSS %1ory · fosite2 Eki 2020
- CVE-2020-1523319İzleyin
OAuth2 Redirect URL validity does not respect query parameters and character casing for loopback addresses
OrtaCVSS 4,8İstismar yokEPSS %1ory · fosite2 Eki 2020