CVE-2026-32317 Cryptomator for Android: Tampered vault configuration allows MITM attack on Hub API

Cryptomator for Android offers multi-platform transparent client-side encryption for files in the cloud. Prior to version 1.12.3, an integrity check vulnerability allows an attacker tamper with the vault configuration file leading to a man-in-the-middle vulnerability in Hub key loading mechanism...

EUVD-2024-3342

Malicious code in bioql PyPI...

SUSE-RU-2025:0791-1 Recommended update 4.3.15 for Multi-Linux Manager Client Tools

This update fixes the following issues: ansible: - Security issues fixed: CVE-2024-8775: Fixed issue where sensitive information stored in Ansible Vault files could be exposed in plaintext bsc1230601 spacewalk-client-tools: - Version 4.3.22-0 Allow translation to wrap strings as weblate forces it...

Unauthorized Access

org.keycloak, keycloak-quarkus-server is vulnerable to Unauthorized Access. The vulnerability is due to improper access controls, allowing a high-privileged user to read sensitive information from a Vault file outside the expected context...

GHSA-5545-R4HG-RJ4M Keycloak Path Traversal Vulnerability Due to External Control of File Name or Path

A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. This attacker must have previous high access to the Keycloak server in order to perform resource creation, for example, an LDAP provider...

GHSA-6VRW-MPJ8-3J59 Duplicate Advisory: Keycloak Path Traversal Vulnerability Due to External Control of File Name or Path

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5545-r4hg-rj4m. This link is maintained to preserve external references. Original Description A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file...

Duplicate Advisory: Keycloak Path Traversal Vulnerability Due to External Control of File Name or Path

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5545-r4hg-rj4m. This link is maintained to preserve external references. Original Description A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file...

CVE-2024-10492

A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. This attacker must have previous high access to the Keycloak server in order to perform resource creation, for example, an LDAP provider...

CVE-2024-10492 Keycloak-quarkus-server: keycloak path trasversal

A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. This attacker must have previous high access to the Keycloak server in order to perform resource creation, for example, an LDAP provider...

CVE-2024-10492

CVE-2024-10492 in Keycloak enables a high-privilege user to read a Vault file outside the expected context by leveraging a crafted Vault read file after gaining prior high access (e.g., via LDAP provider configuration). The issue phrasing across connected advisories confirms this path-traversal-l...

keycloak-quarkus-server: Keycloak path trasversal

A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. This attacker must have previous high access to the Keycloak server in order to perform resource creation, for example, an LDAP provider...

keycloak-quarkus-server: Keycloak path trasversal

A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. This attacker must have previous high access to the Keycloak server in order to perform resource creation, for example, an LDAP provider...

CVE-2024-10492

A vulnerability was found in Keycloak. A user with high privileges could read sensitive information from a Vault file that is not within the expected context. This attacker must have previous high access to the Keycloak server in order to perform resource creation, for example, an LDAP provider...

PT-2024-9013

Name of the Vulnerable Software and Affected Versions: Keycloak affected versions not specified Red Hat products affected versions not specified Description: A vulnerability was found in Keycloak, allowing a user with high privileges to read sensitive information from a Vault file that is not...

PT-2024-31743

Name of the Vulnerable Software and Affected Versions: TopBraid EDG versions prior to 7.3 TopBraid EDG versions 7.1.3 Description: TopBraid EDG stores external credentials insecurely, allowing an authenticated attacker with file system access to read edg-setup.properties and obtain the secret to...

CVE-2022-3284

Download key for a file in a vault was passed in an insecure way that could easily be logged in M-Files New Web in M-Files before 22.11.12011.0. This issue affects M-Files New Web: before 22.11.12011.0...

DEBIAN-CVE-2014-4658

The vault subsystem in Ansible before 1.5.5 does not set the umask before creation or modification of a vault file, which allows local users to obtain sensitive key information by reading a file...