CVE-2018-18417: Improper Neutralization of Input During Web Page Generation

In the 3.1 version of Ekushey Project Manager CRM, Stored XSS has been discovered in the input and upload sections, as demonstrated by the name parameter to the index.php/admin/client/create URI...

PT-2018-14448

Name of the Vulnerable Software and Affected Versions Ekushey Project Manager CRM version 3.1 Description A Stored XSS issue has been found in the input and upload sections of the software. This is demonstrated by the name parameter to the "index.php/admin/client/create" URI. Recommendations For...

org.hawkular.accounts:hawkular-accounts (>=2.0.23.final, <=2.0.39.final), org.hawkular.accounts:hawkular-accounts-api (>=2.0.23.final, <=2.0.39.final) +53 more potentially affected by CVE-2017-12161 via org.keycloak:keycloak-core (1.9.1.final)

org.keycloak:keycloak-core MAVEN version 1.9.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.hawkular.accounts:hawkular-accounts =2.0.23.final, =2.0.23.final, =2.0.23.final, =2.0.23.final,...

org.keycloak:keycloak-adapter-core (2.3.0.final), org.keycloak:keycloak-admin-client (2.3.0.final) +51 more potentially affected by CVE-2017-12161 via org.keycloak:keycloak-core (2.3.0.final)

org.keycloak:keycloak-core MAVEN version 2.3.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-adapter-core 2.3.0.final - org.keycloak:keycloak-admin-client 2.3.0.final -...

com.gitblit.fathom:fathom-security-keycloak (>=0.8.4, <=1.0.1), org.commonjava.indy.embed:indy-embedder (>=1.3.0, <=1.5.0.3) +54 more potentially affected by CVE-2017-12161 via org.keycloak:keycloak-core (1.9.8.final)

org.keycloak:keycloak-core MAVEN version 1.9.8.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.gitblit.fathom:fathom-security-keycloak =0.8.4, =1.3.0, =1.0.0, =1.0.0, =1.0.0, =1.0, =1.1.0,...

org.hawkular.accounts:hawkular-accounts (>=2.0.14.final, <=2.0.17.final), org.hawkular.accounts:hawkular-accounts-api (>=2.0.14.final, <=2.0.17.final) +91 more potentially affected by CVE-2017-12161 via org.keycloak:keycloak-core (1.8.0.cr3)

org.keycloak:keycloak-core MAVEN version 1.8.0.cr3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.hawkular.accounts:hawkular-accounts =2.0.14.final, =2.0.14.final, =2.0.14.final, =2.0.14.final,...

org.keycloak:keycloak-account-api (1.8.0.cr2), org.keycloak:keycloak-account-freemarker (1.8.0.cr2) +82 more potentially affected by CVE-2017-12161 via org.keycloak:keycloak-core (1.8.0.cr2)

org.keycloak:keycloak-core MAVEN version 1.8.0.cr2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-account-api 1.8.0.cr2 - org.keycloak:keycloak-account-freemarker 1.8.0.cr2 -...

org.keycloak:keycloak-adapter-core (2.2.1.final), org.keycloak:keycloak-admin-client (2.2.1.final) +51 more potentially affected by CVE-2017-12161 via org.keycloak:keycloak-core (2.2.1.final)

org.keycloak:keycloak-core MAVEN version 2.2.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-adapter-core 2.2.1.final - org.keycloak:keycloak-admin-client 2.2.1.final -...

org.hawkular.accounts:hawkular-accounts (>=2.0.20.final, <=2.0.22.final), org.hawkular.accounts:hawkular-accounts-api (>=2.0.20.final, <=2.0.22.final) +93 more potentially affected by CVE-2017-12161 via org.keycloak:keycloak-core (1.8.1.final)

org.keycloak:keycloak-core MAVEN version 1.8.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.hawkular.accounts:hawkular-accounts =2.0.20.final, =2.0.20.final, =2.0.20.final, =2.0.20.final,...

org.keycloak:keycloak-adapter-core (2.3.0.cr1), org.keycloak:keycloak-admin-client (2.3.0.cr1) +51 more potentially affected by CVE-2017-12161 via org.keycloak:keycloak-core (2.3.0.cr1)

org.keycloak:keycloak-core MAVEN version 2.3.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-adapter-core 2.3.0.cr1 - org.keycloak:keycloak-admin-client 2.3.0.cr1 -...

org.keycloak:keycloak-adapter-core (2.4.0.cr1), org.keycloak:keycloak-admin-client (2.4.0.cr1) +52 more potentially affected by CVE-2017-12161 via org.keycloak:keycloak-core (2.4.0.cr1)

org.keycloak:keycloak-core MAVEN version 2.4.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-adapter-core 2.4.0.cr1 - org.keycloak:keycloak-admin-client 2.4.0.cr1 -...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (1.0.0.final), org.jboss.aerogear.unifiedpush:unifiedpush-jaxrs (1.0.0.final) +50 more potentially affected by CVE-2017-12161 via org.keycloak:keycloak-core (1.0-rc-1)

org.keycloak:keycloak-core MAVEN version 1.0-rc-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server 1.0.0.final -...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (1.0.3), org.jboss.aerogear.unifiedpush:unifiedpush-jaxrs (1.0.3) +51 more potentially affected by CVE-2017-12161 via org.keycloak:keycloak-core (1.0.5.final)

org.keycloak:keycloak-core MAVEN version 1.0.5.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server 1.0.3 -...

org.keycloak:keycloak-adapter-core (2.5.0.final), org.keycloak:keycloak-admin-client (2.5.0.final) +52 more potentially affected by CVE-2017-12161 via org.keycloak:keycloak-core (2.5.0.final)

org.keycloak:keycloak-core MAVEN version 2.5.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-adapter-core 2.5.0.final - org.keycloak:keycloak-admin-client 2.5.0.final -...

com.canoo.dolphin-platform:dolphin-platform-security-client (>=0.19.0, <=1.0.0.cr3), com.canoo.dolphin-platform:dolphin-platform-security-server (>=0.19.0, <=1.0.0.cr3) +89 more potentially affected by CVE-2017-12161 via org.keycloak:keycloak-core (>=3.0.0.cr1, <=3.4.1.final)

org.keycloak:keycloak-core MAVEN version =3.0.0.cr1, =0.19.0, =0.19.0, =0.19.0, =0.19.0, =1.0.0, =0.1.0-2, =1.3.0, =1.3.0, =2.0-beta-2, =2.0-beta-2, =1.2.0-beta.2, =2.0.2, =3.0.0.cr1, =3.0.0.cr1, =3.4.1.final and more Source cves: CVE-2017-12161 Source advisory: GHSA-959Q-32G8-VVP7...

org.keycloak:keycloak-account-api (1.0.2.final), org.keycloak:keycloak-account-freemarker (1.0.2.final) +48 more potentially affected by CVE-2017-12161 via org.keycloak:keycloak-core (1.0.2.final)

org.keycloak:keycloak-core MAVEN version 1.0.2.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-account-api 1.0.2.final - org.keycloak:keycloak-account-freemarker 1.0.2.final ...

org.keycloak:keycloak-adapter-core (2.5.1.final), org.keycloak:keycloak-admin-client (2.5.1.final) +52 more potentially affected by CVE-2017-12161 via org.keycloak:keycloak-core (2.5.1.final)

org.keycloak:keycloak-core MAVEN version 2.5.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-adapter-core 2.5.1.final - org.keycloak:keycloak-admin-client 2.5.1.final -...

org.keycloak:keycloak-adapter-core (2.5.0.cr1), org.keycloak:keycloak-admin-client (2.5.0.cr1) +52 more potentially affected by CVE-2017-12161 via org.keycloak:keycloak-core (2.5.0.cr1)

org.keycloak:keycloak-core MAVEN version 2.5.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-adapter-core 2.5.0.cr1 - org.keycloak:keycloak-admin-client 2.5.0.cr1 -...

org.keycloak:keycloak-adapter-core (2.5.1.final), org.keycloak:keycloak-admin-client (2.5.1.final) +52 more potentially affected by CVE-2018-10912 via org.keycloak:keycloak-core (2.5.1.final)

org.keycloak:keycloak-core MAVEN version 2.5.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-adapter-core 2.5.1.final - org.keycloak:keycloak-admin-client 2.5.1.final -...

de.cidaas:cidaas-interceptor-spring-security-xml (0.0.1), org.fintrace:keycloak-event-receiver-common (0.0.1) +67 more potentially affected by CVE-2018-10912 via org.keycloak:keycloak-core (>=4.0.0.beta1, <=4.0.0.beta3)

org.keycloak:keycloak-core MAVEN version =4.0.0.beta1, =0.0.1, =4.0.0.beta1, =4.0.0.beta1, =4.0.0.beta1, =4.0.0.beta1, =4.0.0.beta1, =4.0.0.beta1, =4.0.0.beta1, =4.0.0.beta1, =4.0.0.beta1, =4.0.0.beta1, =4.0.0.beta3 and more Source cves: CVE-2018-10912 Source advisory: OSV:GHSA-H7J7-PW3V-3V3X...