Apache Shiro < 1.8.0 Authentication Bypass

Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. C Tenable, Inc...

com.vaadin:vaadin (>=22.0.6, <=22.0.14), com.vaadin:vaadin-core (>=22.0.6, <=22.0.14) +9 more potentially affected by CVE-2022-29567 via com.vaadin:vaadin-grid-flow (>=22.0.6, <=22.0.14)

com.vaadin:vaadin-grid-flow MAVEN version =22.0.6, =22.0.6, =22.0.6, =22.0.6, =22.0.6, =22.0.6, =22.0.6, =22.0.6, =22.0.6, =22.0.6, =22.0.6, =22.0.6, =22.0.14 Source cves: CVE-2022-29567 Source advisory: GHSA-QFR3-323W-QV27...

de.adorsys.oauth:oauth-wildfly-support (>=0.12, <=0.35), io.undertow:undertow-servlet (1.1.8.final) +4 more potentially affected by CVE-2021-3629 via io.undertow:undertow-core (1.1.8.final)

io.undertow:undertow-core MAVEN version 1.1.8.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - de.adorsys.oauth:oauth-wildfly-support =0.12, =7.12.0, =1.2.6.release, =1.2.7.release -...

io.undertow:undertow-servlet (1.3.28.final), io.undertow:undertow-websockets-jsr (1.3.28.final) +1 more potentially affected by CVE-2021-3629 via io.undertow:undertow-core (1.3.28.final)

io.undertow:undertow-core MAVEN version 1.3.28.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.3.28.final - io.undertow:undertow-websockets-jsr 1.3.28.final -...

com.github.dkubiak:goldfish-collector-maven (1.0), com.github.dkubiak:goldfish-server (1.0) +3 more potentially affected by CVE-2021-3629 via io.undertow:undertow-core (1.1.4.final)

io.undertow:undertow-core MAVEN version 1.1.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.github.dkubiak:goldfish-collector-maven 1.0 - com.github.dkubiak:goldfish-server 1.0 -...

io.undertow:undertow-servlet (1.3.28.final), io.undertow:undertow-websockets-jsr (1.3.28.final) +1 more potentially affected by CVE-2021-3597 via io.undertow:undertow-core (1.3.28.final)

io.undertow:undertow-core MAVEN version 1.3.28.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.3.28.final - io.undertow:undertow-websockets-jsr 1.3.28.final -...

io.undertow:undertow-servlet (1.1.7.final), io.undertow:undertow-websockets-jsr (1.1.7.final) +1 more potentially affected by CVE-2021-3597 via io.undertow:undertow-core (1.1.7.final)

io.undertow:undertow-core MAVEN version 1.1.7.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.1.7.final - io.undertow:undertow-websockets-jsr 1.1.7.final -...

io.undertow:undertow-servlet (1.1.9.final), io.undertow:undertow-websockets-jsr (1.1.9.final) +1 more potentially affected by CVE-2021-3597 via io.undertow:undertow-core (1.1.9.final)

io.undertow:undertow-core MAVEN version 1.1.9.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.1.9.final - io.undertow:undertow-websockets-jsr 1.1.9.final -...

org.keycloak:keycloak-adapter-core (2.2.0.final), org.keycloak:keycloak-fuse-adapter-dist (2.2.0.final) +12 more potentially affected by CVE-2019-10169 via org.keycloak:keycloak-authz-client (2.2.0.final)

org.keycloak:keycloak-authz-client MAVEN version 2.2.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-authz-client and may be impacted: - org.keycloak:keycloak-adapter-core 2.2.0.final -...

org.keycloak:keycloak-adapter-core (2.5.1.final), org.keycloak:keycloak-fuse-adapter-dist (2.5.1.final) +12 more potentially affected by CVE-2019-10169 via org.keycloak:keycloak-authz-client (2.5.1.final)

org.keycloak:keycloak-authz-client MAVEN version 2.5.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-authz-client and may be impacted: - org.keycloak:keycloak-adapter-core 2.5.1.final -...

edu.byu.hbll.maven:application-parent (>=3.0.0, <=3.4.0), org.keycloak:keycloak-adapter-core (4.8.2.final) +17 more potentially affected by CVE-2019-10169 via org.keycloak:keycloak-authz-client (4.8.2.final)

org.keycloak:keycloak-authz-client MAVEN version 4.8.2.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-authz-client and may be impacted: - edu.byu.hbll.maven:application-parent =3.0.0, =3.4.0 -...

org.keycloak:keycloak-adapter-core (2.1.0.cr1), org.keycloak:keycloak-spring-boot-adapter (2.1.0.cr1) +11 more potentially affected by CVE-2019-10169 via org.keycloak:keycloak-authz-client (2.1.0.cr1)

org.keycloak:keycloak-authz-client MAVEN version 2.1.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-authz-client and may be impacted: - org.keycloak:keycloak-adapter-core 2.1.0.cr1 - org.keycloak:keycloak-spring-boot-adapte...

org.keycloak:keycloak-adapter-core (2.2.0.cr1), org.keycloak:keycloak-fuse-adapter-dist (2.2.0.cr1) +12 more potentially affected by CVE-2019-10169 via org.keycloak:keycloak-authz-client (2.2.0.cr1)

org.keycloak:keycloak-authz-client MAVEN version 2.2.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-authz-client and may be impacted: - org.keycloak:keycloak-adapter-core 2.2.0.cr1 - org.keycloak:keycloak-fuse-adapter-dist...

org.keycloak:keycloak-adapter-core (3.3.0.cr1), org.keycloak:keycloak-fuse-adapter-dist (3.3.0.cr1) +10 more potentially affected by CVE-2019-10169 via org.keycloak:keycloak-authz-client (3.3.0.cr1)

org.keycloak:keycloak-authz-client MAVEN version 3.3.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-authz-client and may be impacted: - org.keycloak:keycloak-adapter-core 3.3.0.cr1 - org.keycloak:keycloak-fuse-adapter-dist...

org.keycloak:keycloak-adapter-core (3.4.1.cr1), org.keycloak:keycloak-fuse-adapter-dist (3.4.1.cr1) +10 more potentially affected by CVE-2019-10169 via org.keycloak:keycloak-authz-client (3.4.1.cr1)

org.keycloak:keycloak-authz-client MAVEN version 3.4.1.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-authz-client and may be impacted: - org.keycloak:keycloak-adapter-core 3.4.1.cr1 - org.keycloak:keycloak-fuse-adapter-dist...

org.keycloak:keycloak-adapter-core (3.2.0.cr1), org.keycloak:keycloak-fuse-adapter-dist (3.2.0.cr1) +10 more potentially affected by CVE-2019-10169 via org.keycloak:keycloak-authz-client (3.2.0.cr1)

org.keycloak:keycloak-authz-client MAVEN version 3.2.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-authz-client and may be impacted: - org.keycloak:keycloak-adapter-core 3.2.0.cr1 - org.keycloak:keycloak-fuse-adapter-dist...

it.vige:school-app-jsf (1.3.1), org.keycloak:keycloak-adapter-core (5.0.0) +17 more potentially affected by CVE-2019-10169 via org.keycloak:keycloak-authz-client (5.0.0)

org.keycloak:keycloak-authz-client MAVEN version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-authz-client and may be impacted: - it.vige:school-app-jsf 1.3.1 - org.keycloak:keycloak-adapter-core 5.0.0 -...

org.keycloak:keycloak-adapter-core (3.4.0.cr1), org.keycloak:keycloak-fuse-adapter-dist (3.4.0.cr1) +10 more potentially affected by CVE-2019-10169 via org.keycloak:keycloak-authz-client (3.4.0.cr1)

org.keycloak:keycloak-authz-client MAVEN version 3.4.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-authz-client and may be impacted: - org.keycloak:keycloak-adapter-core 3.4.0.cr1 - org.keycloak:keycloak-fuse-adapter-dist...

org.keycloak:keycloak-adapter-core (3.0.0.cr1), org.keycloak:keycloak-default-spring-boot-starter (3.0.0.cr1) +13 more potentially affected by CVE-2019-10169 via org.keycloak:keycloak-authz-client (3.0.0.cr1)

org.keycloak:keycloak-authz-client MAVEN version 3.0.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-authz-client and may be impacted: - org.keycloak:keycloak-adapter-core 3.0.0.cr1 -...

org.fintrace:microservice-keycloak-support (0.0.1), org.keycloak:keycloak-adapter-core (4.0.0.beta1) +15 more potentially affected by CVE-2019-10169 via org.keycloak:keycloak-authz-client (4.0.0.beta1)

org.keycloak:keycloak-authz-client MAVEN version 4.0.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-authz-client and may be impacted: - org.fintrace:microservice-keycloak-support 0.0.1 - org.keycloak:keycloak-adapter-core...