Security Bulletin: IBM i Modernization Engine for Lifecycle Integration is vulnerable to cross-site scripting (CVE-2022-0225)

Summary IBM i Modernization Engine for Lifecycle Integration platform component is vulnerable to cross-site scripting as described in the Vulnerability Details section. These components are used in IBM i Modernization Engine for Lifecycle Integration for infrastructure support in the platform. IB...

com.abavilla:fpi-bot-api (>=1.2.0, <=1.5.0), com.abavilla:fpi-bot-api-core (>=1.2.0, <=1.3.1) +138 more potentially affected by CVE-2022-0225 via org.keycloak:keycloak-core (19.0.3)

org.keycloak:keycloak-core MAVEN version 19.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.abavilla:fpi-bot-api =1.2.0, =1.2.0, =1.2.0, =1.3.2, =1.5.0, =1.5.0, =1.2.1, =1.2.1, =1.2.1, =1.3.2,...

org.hawkular.accounts:hawkular-accounts-api (>=1.0.6, <=1.0.16.final), org.hawkular.accounts:hawkular-accounts-common (>=1.0.14.final, <=1.0.16.final) +99 more potentially affected by CVE-2022-0225 via org.keycloak:keycloak-core (1.3.1.final)

org.keycloak:keycloak-core MAVEN version 1.3.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.hawkular.accounts:hawkular-accounts-api =1.0.6, =1.0.14.final, =1.0.6, =1.0.7.final, =1.0.7.final...

com.c4-soft.springaddons:spring-security-oauth2-test-addons (>=2.0.0, <=2.0.3), com.c4-soft.springaddons:spring-security-oauth2-test-webflux-addons (>=2.0.0, <=2.0.3) +67 more potentially affected by CVE-2022-0225 via org.keycloak:keycloak-core (9.0.0)

org.keycloak:keycloak-core MAVEN version 9.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.c4-soft.springaddons:spring-security-oauth2-test-addons =2.0.0, =2.0.0, =2.0.0, =1.1.0, =1.1.0, =1.1.0,...

com.mjamsek.auth:kee-auth (1.0.0), de.retest:recheck (>=1.6.0-beta.1, <=1.7.0) +105 more potentially affected by CVE-2022-0225 via org.keycloak:keycloak-core (7.0.1)

org.keycloak:keycloak-core MAVEN version 7.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.mjamsek.auth:kee-auth 1.0.0 - de.retest:recheck =1.6.0-beta.1, =1.6.0-beta.1, =1.6.0-beta.1,...

com.github.vzakharchenko:keycloak-plugins (>=0.1, <=1.0.1), com.github.vzakharchenko:mikrotik-radius-plugin (>=0.1, <=1.0.1) +93 more potentially affected by CVE-2022-0225 via org.keycloak:keycloak-core (8.0.1)

org.keycloak:keycloak-core MAVEN version 8.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.github.vzakharchenko:keycloak-plugins =0.1, =0.1, =0.1, =0.1, =1.8.0-beta.1, =1.8.0-beta.1,...

io.github.johnjcool:keycloak-cas-services (4.5.0.final), io.github.pablobastidasv:kc (1.3) +77 more potentially affected by CVE-2022-0225 via org.keycloak:keycloak-core (4.5.0.final)

org.keycloak:keycloak-core MAVEN version 4.5.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.github.johnjcool:keycloak-cas-services 4.5.0.final - io.github.pablobastidasv:kc 1.3 -...

org.keycloak:keycloak-adapter-core (4.7.0.final), org.keycloak:keycloak-admin-client (4.7.0.final) +63 more potentially affected by CVE-2022-0225 via org.keycloak:keycloak-core (4.7.0.final)

org.keycloak:keycloak-core MAVEN version 4.7.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-adapter-core 4.7.0.final - org.keycloak:keycloak-admin-client 4.7.0.final -...

it.vige:school-jsf (>=1.2.0, <=1.2.1), org.keycloak:keycloak-adapter-core (4.8.1.final) +64 more potentially affected by CVE-2022-0225 via org.keycloak:keycloak-core (4.8.1.final)

org.keycloak:keycloak-core MAVEN version 4.8.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - it.vige:school-jsf =1.2.0, =1.2.1 - org.keycloak:keycloak-adapter-core 4.8.1.final -...

edu.byu.hbll.maven:application-parent (>=3.0.0, <=3.4.0), org.keycloak:keycloak-adapter-core (4.8.2.final) +64 more potentially affected by CVE-2022-0225 via org.keycloak:keycloak-core (4.8.2.final)

org.keycloak:keycloak-core MAVEN version 4.8.2.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - edu.byu.hbll.maven:application-parent =3.0.0, =3.4.0 - org.keycloak:keycloak-adapter-core 4.8.2.final...

com.c4-soft.springaddons:spring-security-test-keycloack-addons (1.2.0), com.github.vzakharchenko:keycloak-plugins (1.0.2) +64 more potentially affected by CVE-2022-0225 via org.keycloak:keycloak-core (8.0.2)

org.keycloak:keycloak-core MAVEN version 8.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.c4-soft.springaddons:spring-security-test-keycloack-addons 1.2.0 -...

io.apicurio:apicurio-studio-be-hub-api (0.2.15.final), io.apicurio:apicurio-studio-fe-servlet (0.2.15.final) +66 more potentially affected by CVE-2022-0225 via org.keycloak:keycloak-core (4.1.0.final)

org.keycloak:keycloak-core MAVEN version 4.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.apicurio:apicurio-studio-be-hub-api 0.2.15.final - io.apicurio:apicurio-studio-fe-servlet...

org.jboss.aerogear.unifiedpush:unifiedpush-service (1.2.3.final), org.keycloak:keycloak-adapter-core (3.4.2.final) +57 more potentially affected by CVE-2022-0225 via org.keycloak:keycloak-core (3.4.2.final)

org.keycloak:keycloak-core MAVEN version 3.4.2.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-service 1.2.3.final - org.keycloak:keycloak-adapter-core...

org.hawkular.accounts:hawkular-accounts (>=2.0.14.final, <=2.0.17.final), org.hawkular.accounts:hawkular-accounts-api (>=2.0.14.final, <=2.0.17.final) +91 more potentially affected by CVE-2022-0225 via org.keycloak:keycloak-core (1.8.0.cr3)

org.keycloak:keycloak-core MAVEN version 1.8.0.cr3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.hawkular.accounts:hawkular-accounts =2.0.14.final, =2.0.14.final, =2.0.14.final, =2.0.14.final,...

de.ahus1.keycloak.dropwizard:keycloak-dropwizard (0.6.0), org.hawkular.accounts:hawkular-accounts (>=2.0.18.final, <=2.0.19.final) +89 more potentially affected by CVE-2022-0225 via org.keycloak:keycloak-core (1.8.0.final)

org.keycloak:keycloak-core MAVEN version 1.8.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - de.ahus1.keycloak.dropwizard:keycloak-dropwizard 0.6.0 - org.hawkular.accounts:hawkular-accounts...

com.github.vzakharchenko:keycloak-plugins (1.2.4), com.github.vzakharchenko:mikrotik-radius-plugin (1.2.4) +97 more potentially affected by CVE-2022-0225 via org.keycloak:keycloak-core (10.0.1)

org.keycloak:keycloak-core MAVEN version 10.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.github.vzakharchenko:keycloak-plugins 1.2.4 - com.github.vzakharchenko:mikrotik-radius-plugin 1.2.4 -...

io.quarkus:quarkus-keycloak-admin-client (>=1.5.0.cr1, <=1.5.0.final), io.quarkus:quarkus-keycloak-admin-client-deployment (>=1.5.0.cr1, <=1.5.0.final) +63 more potentially affected by CVE-2022-0225 via org.keycloak:keycloak-core (10.0.0)

org.keycloak:keycloak-core MAVEN version 10.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.quarkus:quarkus-keycloak-admin-client =1.5.0.cr1, =1.5.0.cr1, =1.5.0.cr1, =1.5.0.cr1, =0.5.0, =0.5.0,...

com.github.vzakharchenko:chillispot-radius-plugin (1.3.6), com.github.vzakharchenko:cisco-radius-plugin (1.3.6) +137 more potentially affected by CVE-2022-0225 via org.keycloak:keycloak-core (13.0.0)

org.keycloak:keycloak-core MAVEN version 13.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.3.6 - com.github.vzakharchenko:cisco-radius-plugin 1.3...

com.jalalkiswani:smart-cloud-web (>=3.0.0, <=4.0.8), com.jalalkiswani:smart-cloud-web-security (>=4.0.1, <=4.0.8) +79 more potentially affected by CVE-2022-0225 via org.keycloak:keycloak-core (5.0.0)

org.keycloak:keycloak-core MAVEN version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.jalalkiswani:smart-cloud-web =3.0.0, =4.0.1, =4.0.1, =1.1.0, =0.0.4, =0.0.4, =5.1.0, =5.1.2 -...

de.adorsys.sts:keycloak-storage-provider (>=0.29.1, <=0.29.10), de.retest:recheck (>=1.2.0-beta.1, <=1.4.0) +83 more potentially affected by CVE-2022-0225 via org.keycloak:keycloak-core (6.0.1)

org.keycloak:keycloak-core MAVEN version 6.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - de.adorsys.sts:keycloak-storage-provider =0.29.1, =1.2.0-beta.1, =1.3.0-beta.1, =0.0.7, =0.0.7, =0.0.6,...