io.apiman:apiman-manager-api-jpa (>=3.0.0.rc6, <=3.1.3.final), io.apiman:apiman-manager-api-micro (>=3.0.0.rc6, <=3.1.3.final) +8 more potentially affected by CVE-2026-3293 via net.snowflake:snowflake-jdbc (3.13.21)

net.snowflake:snowflake-jdbc MAVEN version 3.13.21 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc and may be impacted: - io.apiman:apiman-manager-api-jpa =3.0.0.rc6, =3.0.0.rc6, =3.0.0.rc6, =3.0.0.rc6, =4.15.0, =16.17.1,...

EUVD-2023-0494

Malicious code in bioql PyPI...

CVE-2023-28640

Apiman is a flexible and open source API Management platform. Due to a missing permissions check, an attacker with an authenticated Apiman Manager account may be able to gain access to API keys they do not have permission for if they correctly guess the URL, which includes Organisation ID, Client...

io.apiman.plugins:apiman-plugins-keycloak-oauth-policy (>=1.2.4.final, <=1.2.6.beta1), io.apiman:apiman-distro-eap7 (>=1.2.4.final, <=1.2.6.beta1) +48 more potentially affected by CVE-2024-10039 via org.keycloak:keycloak-core (1.9.2.final)

org.keycloak:keycloak-core MAVEN version 1.9.2.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.apiman.plugins:apiman-plugins-keycloak-oauth-policy =1.2.4.final, =1.2.4.final, =1.2.4.final,...

io.apiman.plugins:apiman-plugins-keycloak-oauth-policy (>=1.2.7.beta1, <=1.2.7.final), io.apiman:apiman-distro-eap7 (>=1.2.7.beta1, <=1.2.7.final) +49 more potentially affected by CVE-2024-7318 via org.keycloak:keycloak-core (1.9.7.final)

org.keycloak:keycloak-core MAVEN version 1.9.7.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.apiman.plugins:apiman-plugins-keycloak-oauth-policy =1.2.7.beta1, =1.2.7.beta1, =1.2.7.beta1,...

io.apiman:apiman-gateway-engine-ispn (1.2.2.final), io.apiman:apiman-manager-api-ispn (1.2.2.final) +48 more potentially affected by CVE-2023-5384 via org.infinispan:infinispan-commons (8.1.1.final)

org.infinispan:infinispan-commons MAVEN version 8.1.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-commons and may be impacted: - io.apiman:apiman-gateway-engine-ispn 1.2.2.final - io.apiman:apiman-manager-api-ispn...

io.apiman.plugins:apiman-plugins-keycloak-oauth-policy (>=1.1.3.final, <=1.2.1.final), io.apiman:apiman-manager-api-security (>=1.1.2.final, <=1.1.3.final) +82 more potentially affected by CVE-2023-0105 via org.keycloak:keycloak-core (1.2.0.cr1)

org.keycloak:keycloak-core MAVEN version 1.2.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.apiman.plugins:apiman-plugins-keycloak-oauth-policy =1.1.3.final, =1.1.2.final, =1.1.2.final,...

GHSA-M6F8-HJRV-MW5F Apiman vulnerable to permissions bypass due to missing check on API key URL

Impact Due to a missing permissions check, an attacker with an authenticated Apiman Manager account may be able to gain access to API keys they do not have permission for if they correctly guess the URL. The URL includes Organisation ID, Client ID, and Client Version of the targeted non-permitted...

Apiman vulnerable to permissions bypass due to missing check on API key URL

Impact Due to a missing permissions check, an attacker with an authenticated Apiman Manager account may be able to gain access to API keys they do not have permission for if they correctly guess the URL. The URL includes Organisation ID, Client ID, and Client Version of the targeted non-permitted...

io.apiman:apiman-distro-db (1.1.5.final), io.apiman:apiman-distro-db-es (1.1.5.final) +7 more potentially affected by CVE-2023-28640 via io.apiman:apiman-manager-api-rest-impl (1.1.5.final)

io.apiman:apiman-manager-api-rest-impl MAVEN version 1.1.5.final is affected by a known vulnerability. The following packages have a transitive dependency on io.apiman:apiman-manager-api-rest-impl and may be impacted: - io.apiman:apiman-distro-db 1.1.5.final - io.apiman:apiman-distro-db-es...

io.apiman:apiman-distro-db (1.1.6.final), io.apiman:apiman-distro-db-es (1.1.6.final) +8 more potentially affected by CVE-2023-28640 via io.apiman:apiman-manager-api-rest-impl (1.1.6.final)

io.apiman:apiman-manager-api-rest-impl MAVEN version 1.1.6.final is affected by a known vulnerability. The following packages have a transitive dependency on io.apiman:apiman-manager-api-rest-impl and may be impacted: - io.apiman:apiman-distro-db 1.1.6.final - io.apiman:apiman-distro-db-es...

io.apiman:apiman-distro-db (1.2.0.alpha3), io.apiman:apiman-distro-db-es (1.2.0.alpha3) +6 more potentially affected by CVE-2023-28640 via io.apiman:apiman-manager-api-rest-impl (1.2.0.alpha3)

io.apiman:apiman-manager-api-rest-impl MAVEN version 1.2.0.alpha3 is affected by a known vulnerability. The following packages have a transitive dependency on io.apiman:apiman-manager-api-rest-impl and may be impacted: - io.apiman:apiman-distro-db 1.2.0.alpha3 - io.apiman:apiman-distro-db-es...

io.apiman:apiman-distro-db (1.2.2.final), io.apiman:apiman-distro-db-es (1.2.2.final) +10 more potentially affected by CVE-2023-28640 via io.apiman:apiman-manager-api-rest-impl (1.2.2.final)

io.apiman:apiman-manager-api-rest-impl MAVEN version 1.2.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.apiman:apiman-manager-api-rest-impl and may be impacted: - io.apiman:apiman-distro-db 1.2.2.final - io.apiman:apiman-distro-db-es...

io.apiman:apiman-manager-api-micro (1.4.1.final), io.apiman:apiman-manager-api-war (1.4.1.final) +3 more potentially affected by CVE-2023-28640 via io.apiman:apiman-manager-api-rest-impl (1.4.1.final)

io.apiman:apiman-manager-api-rest-impl MAVEN version 1.4.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.apiman:apiman-manager-api-rest-impl and may be impacted: - io.apiman:apiman-manager-api-micro 1.4.1.final -...

io.apiman:apiman-manager-api-micro (1.4.2.final), io.apiman:apiman-manager-api-war (1.4.2.final) +3 more potentially affected by CVE-2023-28640 via io.apiman:apiman-manager-api-rest-impl (1.4.2.final)

io.apiman:apiman-manager-api-rest-impl MAVEN version 1.4.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.apiman:apiman-manager-api-rest-impl and may be impacted: - io.apiman:apiman-manager-api-micro 1.4.2.final -...

io.apiman:apiman-manager-api-micro (1.5.2.final), io.apiman:apiman-manager-api-war (1.5.2.final) +3 more potentially affected by CVE-2023-28640 via io.apiman:apiman-manager-api-rest-impl (1.5.2.final)

io.apiman:apiman-manager-api-rest-impl MAVEN version 1.5.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.apiman:apiman-manager-api-rest-impl and may be impacted: - io.apiman:apiman-manager-api-micro 1.5.2.final -...

io.apiman:apiman-manager-api-micro (1.5.6.final), io.apiman:apiman-manager-api-war (1.5.6.final) +3 more potentially affected by CVE-2023-28640 via io.apiman:apiman-manager-api-rest-impl (1.5.6.final)

io.apiman:apiman-manager-api-rest-impl MAVEN version 1.5.6.final is affected by a known vulnerability. The following packages have a transitive dependency on io.apiman:apiman-manager-api-rest-impl and may be impacted: - io.apiman:apiman-manager-api-micro 1.5.6.final -...

io.apiman:apiman-manager-api-micro (2.1.0.final), io.apiman:apiman-manager-test-api (2.1.0.final) +1 more potentially affected by CVE-2023-28640 via io.apiman:apiman-manager-api-rest-impl (2.1.0.final)

io.apiman:apiman-manager-api-rest-impl MAVEN version 2.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.apiman:apiman-manager-api-rest-impl and may be impacted: - io.apiman:apiman-manager-api-micro 2.1.0.final -...

io.apiman:apiman-manager-api-micro (2.1.3.final), io.apiman:apiman-manager-test-api (2.1.3.final) +1 more potentially affected by CVE-2023-28640 via io.apiman:apiman-manager-api-rest-impl (2.1.3.final)

io.apiman:apiman-manager-api-rest-impl MAVEN version 2.1.3.final is affected by a known vulnerability. The following packages have a transitive dependency on io.apiman:apiman-manager-api-rest-impl and may be impacted: - io.apiman:apiman-manager-api-micro 2.1.3.final -...

io.apiman:apiman-manager-api-micro (2.1.4.final), io.apiman:apiman-manager-test-api (2.1.4.final) +1 more potentially affected by CVE-2023-28640 via io.apiman:apiman-manager-api-rest-impl (2.1.4.final)

io.apiman:apiman-manager-api-rest-impl MAVEN version 2.1.4.final is affected by a known vulnerability. The following packages have a transitive dependency on io.apiman:apiman-manager-api-rest-impl and may be impacted: - io.apiman:apiman-manager-api-micro 2.1.4.final -...