CVE-2021-21708

In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTERVALIDATEFLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in...

DEBIAN-CVE-2021-21708

In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTERVALIDATEFLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in...

Memory corruption

In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTERVALIDATEFLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in...

CVE-2021-21708 UAF due to php_filter_float() failing

In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTERVALIDATEFLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in...

CVE-2021-21708

In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTERVALIDATEFLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in...

Attacker may DDOS Withdrawal by Making Multiple Small Requests to withdraw()

Lines of code Vulnerability details Impact 1. Attacker call function withdraw with lowest amount eg. 1 0.000001 VUSD 2. The withdrawal request will go into waiting list in variable "withdrawals" 3. Attacker can repeat Step 1 & 2 to make Making Multiple Small Requests to withdraw until pending...

CVE-2021-21708

In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTERVALIDATEFLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in...

org.keycloak:keycloak-account-freemarker (1.0-rc-2), org.keycloak:keycloak-dependencies-server-all (1.0-rc-2) +3 more potentially affected by CVE-2020-10776 via org.keycloak:keycloak-services (1.0-rc-2)

org.keycloak:keycloak-services MAVEN version 1.0-rc-2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.0-rc-2 - org.keycloak:keycloak-dependencies-server-al...

io.github.johnjcool:keycloak-cas-services (>=4.3.0.final, <=4.3.1.final), org.keycloak:keycloak-authz-policy-common (4.3.0.final) +10 more potentially affected by CVE-2020-10776 via org.keycloak:keycloak-server-spi-private (4.3.0.final)

org.keycloak:keycloak-server-spi-private MAVEN version 4.3.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - io.github.johnjcool:keycloak-cas-services =4.3.0.final, =4.3.1.final -...

org.keycloak:keycloak-authz-policy-common (2.4.0.cr1), org.keycloak:keycloak-authz-policy-drools (2.4.0.cr1) +12 more potentially affected by CVE-2020-10776 via org.keycloak:keycloak-server-spi-private (2.4.0.cr1)

org.keycloak:keycloak-server-spi-private MAVEN version 2.4.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - org.keycloak:keycloak-authz-policy-common 2.4.0.cr1 -...

org.keycloak:keycloak-dependencies-server-all (1.9.5.final), org.keycloak:keycloak-dependencies-server-min (1.9.5.final) +2 more potentially affected by CVE-2020-10776 via org.keycloak:keycloak-services (1.9.5.final)

org.keycloak:keycloak-services MAVEN version 1.9.5.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-all 1.9.5.final -...

org.keycloak:keycloak-authz-policy-common (4.6.0.final), org.keycloak:keycloak-dependencies-server-min (4.6.0.final) +9 more potentially affected by CVE-2020-10776 via org.keycloak:keycloak-server-spi-private (4.6.0.final)

org.keycloak:keycloak-server-spi-private MAVEN version 4.6.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - org.keycloak:keycloak-authz-policy-common 4.6.0.final -...

org.keycloak:keycloak-dependencies-server-all (1.9.1.final), org.keycloak:keycloak-dependencies-server-min (1.9.1.final) +2 more potentially affected by CVE-2020-10776 via org.keycloak:keycloak-services (1.9.1.final)

org.keycloak:keycloak-services MAVEN version 1.9.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-all 1.9.1.final -...

org.keycloak:keycloak-authz-policy-drools (8.0.0), org.keycloak:keycloak-dependencies-server-all (8.0.0) +7 more potentially affected by CVE-2020-10776 via org.keycloak:keycloak-services (8.0.0)

org.keycloak:keycloak-services MAVEN version 8.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 8.0.0 - org.keycloak:keycloak-dependencies-server-all 8.0...

org.keycloak:keycloak-account-freemarker (1.2.0.beta1), org.keycloak:keycloak-broker-oidc (1.2.0.beta1) +4 more potentially affected by CVE-2020-10776 via org.keycloak:keycloak-services (1.2.0.beta1)

org.keycloak:keycloak-services MAVEN version 1.2.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.2.0.beta1 - org.keycloak:keycloak-broker-oidc...

org.keycloak:keycloak-account-freemarker (1.1.0.beta1), org.keycloak:keycloak-dependencies-server-min (1.1.0.beta1) +1 more potentially affected by CVE-2020-10776 via org.keycloak:keycloak-services (1.1.0.beta1)

org.keycloak:keycloak-services MAVEN version 1.1.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.1.0.beta1 -...

io.github.johnjcool:keycloak-cas-services (>=4.2.0.final, <=4.2.1.final), org.keycloak:keycloak-dependencies-server-min (4.2.0.final) +3 more potentially affected by CVE-2020-10776 via org.keycloak:keycloak-services (4.2.0.final)

org.keycloak:keycloak-services MAVEN version 4.2.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - io.github.johnjcool:keycloak-cas-services =4.2.0.final, =4.2.1.final -...

org.keycloak:keycloak-authz-policy-common (6.0.0), org.keycloak:keycloak-authz-policy-drools (6.0.0) +15 more potentially affected by CVE-2020-10776 via org.keycloak:keycloak-server-spi-private (6.0.0)

org.keycloak:keycloak-server-spi-private MAVEN version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - org.keycloak:keycloak-authz-policy-common 6.0.0 -...

org.keycloak:keycloak-authz-policy-common (4.8.1.final), org.keycloak:keycloak-dependencies-server-min (4.8.1.final) +9 more potentially affected by CVE-2020-10776 via org.keycloak:keycloak-server-spi-private (4.8.1.final)

org.keycloak:keycloak-server-spi-private MAVEN version 4.8.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - org.keycloak:keycloak-authz-policy-common 4.8.1.final -...

org.keycloak:keycloak-dependencies-server-all (1.9.4.final), org.keycloak:keycloak-dependencies-server-min (1.9.4.final) +2 more potentially affected by CVE-2020-10776 via org.keycloak:keycloak-services (1.9.4.final)

org.keycloak:keycloak-services MAVEN version 1.9.4.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-all 1.9.4.final -...