MAL-2022-748 Malicious code in @xvideos/auth-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a93bb22648b5540c11735a8901b86f8e243ebb4237cabf6d929d18bb2c3ba806 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in gxm-reference-web-auth-server

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (1.0.0.beta2), org.jboss.aerogear.unifiedpush:unifiedpush-jaxrs (1.0.0.beta2) +49 more potentially affected by CVE-2020-10686 via org.keycloak:keycloak-core (1.0-beta-4)

org.keycloak:keycloak-core MAVEN version 1.0-beta-4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server 1.0.0.beta2 -...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (1.0.0.beta2), org.keycloak:keycloak-dependencies-server-all (1.0-beta-4) potentially affected by CVE-2019-14832 via org.keycloak:keycloak-model-jpa (1.0-beta-4)

org.keycloak:keycloak-model-jpa MAVEN version 1.0-beta-4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-model-jpa and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server 1.0.0.beta2 -...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (>=1.1.0-beta.3, <=1.1.3.final), org.keycloak:keycloak-dependencies-server-all (1.3.1.final) potentially affected by CVE-2019-14832 via org.keycloak:keycloak-model-jpa (1.3.1.final)

org.keycloak:keycloak-model-jpa MAVEN version 1.3.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-model-jpa and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server =1.1.0-beta.3, =1.1.3.final -...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (1.0.1), org.keycloak:keycloak-dependencies-server-all (1.0-final) +1 more potentially affected by CVE-2019-14832 via org.keycloak:keycloak-model-jpa (1.0-final)

org.keycloak:keycloak-model-jpa MAVEN version 1.0-final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-model-jpa and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server 1.0.1 -...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (>=1.1.0-alpha.2, <=1.1.0-beta.1) potentially affected by CVE-2019-14832 via org.keycloak:keycloak-model-jpa (1.1.0.final)

org.keycloak:keycloak-model-jpa MAVEN version 1.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-model-jpa and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server =1.1.0-alpha.2, =1.1.0-beta.1 Source...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (>=1.0.2, <=1.1.0-alpha.1), org.keycloak:keycloak-dependencies-server-all (1.0.4.final) +1 more potentially affected by CVE-2019-14832 via org.keycloak:keycloak-model-jpa (1.0.4.final)

org.keycloak:keycloak-model-jpa MAVEN version 1.0.4.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-model-jpa and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server =1.0.2, =1.1.0-alpha.1 -...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (1.1.0-beta.2), org.keycloak:keycloak-dependencies-server-all (1.2.0.final) potentially affected by CVE-2019-14832 via org.keycloak:keycloak-model-jpa (1.2.0.final)

org.keycloak:keycloak-model-jpa MAVEN version 1.2.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-model-jpa and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server 1.1.0-beta.2 -...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (>=1.2.0-alpha.1, <=1.2.0-beta.1), org.keycloak:keycloak-dependencies-server-all (1.7.0.final) potentially affected by CVE-2019-14832 via org.keycloak:keycloak-model-jpa (1.7.0.final)

org.keycloak:keycloak-model-jpa MAVEN version 1.7.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-model-jpa and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server =1.2.0-alpha.1, =1.2.0-beta.1 -...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (>=0.11.0, <=1.0.0.beta1) potentially affected by CVE-2019-14832 via org.keycloak:keycloak-model-jpa (1.0-beta-3)

org.keycloak:keycloak-model-jpa MAVEN version 1.0-beta-3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-model-jpa and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server =0.11.0, =1.0.0.beta1 Source cves:...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (1.0.0.final), org.keycloak:keycloak-dependencies-server-all (1.0-rc-1) +1 more potentially affected by CVE-2019-14832 via org.keycloak:keycloak-model-jpa (1.0-rc-1)

org.keycloak:keycloak-model-jpa MAVEN version 1.0-rc-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-model-jpa and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server 1.0.0.final -...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (1.0.3), org.keycloak:keycloak-dependencies-server-all (1.0.5.final) +1 more potentially affected by CVE-2019-14832 via org.keycloak:keycloak-model-jpa (1.0.5.final)

org.keycloak:keycloak-model-jpa MAVEN version 1.0.5.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-model-jpa and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server 1.0.3 -...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (>=1.1.0-alpha.2, <=1.1.0-beta.1), org.keycloak:keycloak-account-freemarker (1.1.0.final) +2 more potentially affected by CVE-2018-10894 via org.keycloak:keycloak-services (1.1.0.final)

org.keycloak:keycloak-services MAVEN version 1.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server =1.1.0-alpha.2, =1.1.0-beta.1 -...

de.ahus1.keycloak.dropwizard:keycloak-dropwizard (0.5.0), io.apiman:apiman-distro-wildfly9 (1.2.1.final) +88 more potentially affected by CVE-2018-14658 via org.keycloak:keycloak-core (1.7.0.final)

org.keycloak:keycloak-core MAVEN version 1.7.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - de.ahus1.keycloak.dropwizard:keycloak-dropwizard 0.5.0 - io.apiman:apiman-distro-wildfly9 1.2.1.final...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (>=0.11.0, <=1.0.0.beta1), org.keycloak:keycloak-account-freemarker (1.0-beta-3) +1 more potentially affected by unknown CVE via org.keycloak:keycloak-services (1.0-beta-3)

org.keycloak:keycloak-services MAVEN version 1.0-beta-3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server =0.11.0, =1.0.0.beta1 -...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (>=1.1.0-alpha.2, <=1.1.0-beta.1), org.keycloak:keycloak-account-freemarker (1.1.0.final) +2 more potentially affected by unknown CVE via org.keycloak:keycloak-services (1.1.0.final)

org.keycloak:keycloak-services MAVEN version 1.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server =1.1.0-alpha.2, =1.1.0-beta.1 -...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (>=0.11.0, <=1.0.0.beta1), org.keycloak:keycloak-account-freemarker (1.0-beta-3) +1 more potentially affected by CVE-2021-3424 via org.keycloak:keycloak-services (1.0-beta-3)

org.keycloak:keycloak-services MAVEN version 1.0-beta-3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server =0.11.0, =1.0.0.beta1 -...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (>=1.1.0-alpha.2, <=1.1.0-beta.1), org.keycloak:keycloak-account-freemarker (1.1.0.final) +2 more potentially affected by CVE-2021-3424 via org.keycloak:keycloak-services (1.1.0.final)

org.keycloak:keycloak-services MAVEN version 1.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server =1.1.0-alpha.2, =1.1.0-beta.1 -...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (1.0.0.beta2), org.keycloak:keycloak-account-freemarker (1.0-beta-4) +3 more potentially affected by CVE-2022-1245 via org.keycloak:keycloak-services (1.0-beta-4)

org.keycloak:keycloak-services MAVEN version 1.0-beta-4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server 1.0.0.beta2 -...