CVE-2018-18417: Improper Neutralization of Input During Web Page Generation

In the 3.1 version of Ekushey Project Manager CRM, Stored XSS has been discovered in the input and upload sections, as demonstrated by the name parameter to the index.php/admin/client/create URI...

org.keycloak:keycloak-adapter-core (2.5.0.final), org.keycloak:keycloak-admin-client (2.5.0.final) +52 more potentially affected by CVE-2017-12161 via org.keycloak:keycloak-core (2.5.0.final)

org.keycloak:keycloak-core MAVEN version 2.5.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-adapter-core 2.5.0.final - org.keycloak:keycloak-admin-client 2.5.0.final -...

org.keycloak:keycloak-adapter-core (2.5.1.final), org.keycloak:keycloak-admin-client (2.5.1.final) +52 more potentially affected by CVE-2017-12161 via org.keycloak:keycloak-core (2.5.1.final)

org.keycloak:keycloak-core MAVEN version 2.5.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-adapter-core 2.5.1.final - org.keycloak:keycloak-admin-client 2.5.1.final -...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (1.0.3), org.jboss.aerogear.unifiedpush:unifiedpush-jaxrs (1.0.3) +51 more potentially affected by CVE-2017-12161 via org.keycloak:keycloak-core (1.0.5.final)

org.keycloak:keycloak-core MAVEN version 1.0.5.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server 1.0.3 -...

com.canoo.dolphin-platform:dolphin-platform-security-client (>=0.19.0, <=1.0.0.cr3), com.canoo.dolphin-platform:dolphin-platform-security-server (>=0.19.0, <=1.0.0.cr3) +89 more potentially affected by CVE-2017-12161 via org.keycloak:keycloak-core (>=3.0.0.cr1, <=3.4.1.final)

org.keycloak:keycloak-core MAVEN version =3.0.0.cr1, =0.19.0, =0.19.0, =0.19.0, =0.19.0, =1.0.0, =0.1.0-2, =1.3.0, =1.3.0, =2.0-beta-2, =2.0-beta-2, =1.2.0-beta.2, =2.0.2, =3.0.0.cr1, =3.0.0.cr1, =3.4.1.final and more Source cves: CVE-2017-12161 Source advisory: GHSA-959Q-32G8-VVP7...

org.keycloak:keycloak-adapter-core (2.3.0.final), org.keycloak:keycloak-admin-client (2.3.0.final) +51 more potentially affected by CVE-2017-12161 via org.keycloak:keycloak-core (2.3.0.final)

org.keycloak:keycloak-core MAVEN version 2.3.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-adapter-core 2.3.0.final - org.keycloak:keycloak-admin-client 2.3.0.final -...

org.keycloak:keycloak-adapter-core (2.5.0.cr1), org.keycloak:keycloak-admin-client (2.5.0.cr1) +52 more potentially affected by CVE-2017-12161 via org.keycloak:keycloak-core (2.5.0.cr1)

org.keycloak:keycloak-core MAVEN version 2.5.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-adapter-core 2.5.0.cr1 - org.keycloak:keycloak-admin-client 2.5.0.cr1 -...

org.keycloak:keycloak-adapter-core (2.2.1.final), org.keycloak:keycloak-admin-client (2.2.1.final) +51 more potentially affected by CVE-2017-12161 via org.keycloak:keycloak-core (2.2.1.final)

org.keycloak:keycloak-core MAVEN version 2.2.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-adapter-core 2.2.1.final - org.keycloak:keycloak-admin-client 2.2.1.final -...

org.keycloak:keycloak-adapter-core (2.3.0.cr1), org.keycloak:keycloak-admin-client (2.3.0.cr1) +51 more potentially affected by CVE-2017-12161 via org.keycloak:keycloak-core (2.3.0.cr1)

org.keycloak:keycloak-core MAVEN version 2.3.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-adapter-core 2.3.0.cr1 - org.keycloak:keycloak-admin-client 2.3.0.cr1 -...

org.keycloak:keycloak-adapter-core (2.4.0.cr1), org.keycloak:keycloak-admin-client (2.4.0.cr1) +52 more potentially affected by CVE-2017-12161 via org.keycloak:keycloak-core (2.4.0.cr1)

org.keycloak:keycloak-core MAVEN version 2.4.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-adapter-core 2.4.0.cr1 - org.keycloak:keycloak-admin-client 2.4.0.cr1 -...

com.gitblit.fathom:fathom-security-keycloak (>=0.8.4, <=1.0.1), org.commonjava.indy.embed:indy-embedder (>=1.3.0, <=1.5.0.3) +54 more potentially affected by CVE-2017-12161 via org.keycloak:keycloak-core (1.9.8.final)

org.keycloak:keycloak-core MAVEN version 1.9.8.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.gitblit.fathom:fathom-security-keycloak =0.8.4, =1.3.0, =1.0.0, =1.0.0, =1.0.0, =1.0, =1.1.0,...

org.hawkular.accounts:hawkular-accounts (>=2.0.23.final, <=2.0.39.final), org.hawkular.accounts:hawkular-accounts-api (>=2.0.23.final, <=2.0.39.final) +53 more potentially affected by CVE-2017-12161 via org.keycloak:keycloak-core (1.9.1.final)

org.keycloak:keycloak-core MAVEN version 1.9.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.hawkular.accounts:hawkular-accounts =2.0.23.final, =2.0.23.final, =2.0.23.final, =2.0.23.final,...

org.hawkular.accounts:hawkular-accounts (>=2.0.20.final, <=2.0.22.final), org.hawkular.accounts:hawkular-accounts-api (>=2.0.20.final, <=2.0.22.final) +93 more potentially affected by CVE-2017-12161 via org.keycloak:keycloak-core (1.8.1.final)

org.keycloak:keycloak-core MAVEN version 1.8.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.hawkular.accounts:hawkular-accounts =2.0.20.final, =2.0.20.final, =2.0.20.final, =2.0.20.final,...

org.keycloak:keycloak-account-api (1.0.2.final), org.keycloak:keycloak-account-freemarker (1.0.2.final) +48 more potentially affected by CVE-2017-12161 via org.keycloak:keycloak-core (1.0.2.final)

org.keycloak:keycloak-core MAVEN version 1.0.2.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-account-api 1.0.2.final - org.keycloak:keycloak-account-freemarker 1.0.2.final ...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (1.0.0.final), org.jboss.aerogear.unifiedpush:unifiedpush-jaxrs (1.0.0.final) +50 more potentially affected by CVE-2017-12161 via org.keycloak:keycloak-core (1.0-rc-1)

org.keycloak:keycloak-core MAVEN version 1.0-rc-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server 1.0.0.final -...

org.keycloak:keycloak-account-api (1.8.0.cr2), org.keycloak:keycloak-account-freemarker (1.8.0.cr2) +82 more potentially affected by CVE-2017-12161 via org.keycloak:keycloak-core (1.8.0.cr2)

org.keycloak:keycloak-core MAVEN version 1.8.0.cr2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-account-api 1.8.0.cr2 - org.keycloak:keycloak-account-freemarker 1.8.0.cr2 -...

org.hawkular.accounts:hawkular-accounts (>=2.0.14.final, <=2.0.17.final), org.hawkular.accounts:hawkular-accounts-api (>=2.0.14.final, <=2.0.17.final) +91 more potentially affected by CVE-2017-12161 via org.keycloak:keycloak-core (1.8.0.cr3)

org.keycloak:keycloak-core MAVEN version 1.8.0.cr3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.hawkular.accounts:hawkular-accounts =2.0.14.final, =2.0.14.final, =2.0.14.final, =2.0.14.final,...

org.keycloak:keycloak-adapter-core (2.5.1.final), org.keycloak:keycloak-admin-client (2.5.1.final) +52 more potentially affected by CVE-2018-10912 via org.keycloak:keycloak-core (2.5.1.final)

org.keycloak:keycloak-core MAVEN version 2.5.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-adapter-core 2.5.1.final - org.keycloak:keycloak-admin-client 2.5.1.final -...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (1.0.0.beta2), org.jboss.aerogear.unifiedpush:unifiedpush-jaxrs (1.0.0.beta2) +49 more potentially affected by CVE-2018-10912 via org.keycloak:keycloak-core (1.0-beta-4)

org.keycloak:keycloak-core MAVEN version 1.0-beta-4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server 1.0.0.beta2 -...

org.keycloak:keycloak-account-api (1.2.0.beta1), org.keycloak:keycloak-account-freemarker (1.2.0.beta1) +80 more potentially affected by CVE-2018-10912 via org.keycloak:keycloak-core (1.2.0.beta1)

org.keycloak:keycloak-core MAVEN version 1.2.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-account-api 1.2.0.beta1 - org.keycloak:keycloak-account-freemarker 1.2.0.beta1 ...