Overly Restrictive Account Lockout Mechanism

org.keycloak, keycloak-core is vulnerable to Overly Restrictive Account Lockout Mechanism. The vulnerability is due to improper handling of login attempts, which may allow a remote unauthenticated attacker to block other accounts from logging in by exploiting this flaw under certain conditions...

de.ahus1.keycloak.dropwizard:keycloak-dropwizard (0.5.0), io.apiman:apiman-distro-wildfly9 (1.2.1.final) +88 more potentially affected by CVE-2023-6927 via org.keycloak:keycloak-core (1.7.0.final)

org.keycloak:keycloak-core MAVEN version 1.7.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - de.ahus1.keycloak.dropwizard:keycloak-dropwizard 0.5.0 - io.apiman:apiman-distro-wildfly9 1.2.1.final...

com.github.vzakharchenko:chillispot-radius-plugin (1.4.11), com.github.vzakharchenko:cisco-radius-plugin (1.4.11) +15 more potentially affected by CVE-2022-2232 via org.keycloak:keycloak-ldap-federation (21.0.0)

org.keycloak:keycloak-ldap-federation MAVEN version 21.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.4.11 -...

de.adorsys.keycloak:user-secret-adapter-embedded (1.0.7), de.adorsys.keycloak:user-secret-auth-provider (1.0.7) +12 more potentially affected by CVE-2022-2232 via org.keycloak:keycloak-services (7.0.0)

org.keycloak:keycloak-services MAVEN version 7.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.keycloak:user-secret-adapter-embedded 1.0.7 -...

io.kokuwa.keycloak:keycloak-event-metrics (0.2.1), org.keycloak:keycloak-crypto-fips1402 (21.1.0) +13 more potentially affected by CVE-2022-2232 via org.keycloak:keycloak-services (21.1.0)

org.keycloak:keycloak-services MAVEN version 21.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - io.kokuwa.keycloak:keycloak-event-metrics 0.2.1 - org.keycloak:keycloak-crypto-fips1402 21.1.0 -...

fr.cnieg.keycloak:attribute-login-provider (1.3.11), io.github.jeff-tian:keycloak-services-social-weixin (>=0.5.35, <=0.5.40) +15 more potentially affected by CVE-2022-2232 via org.keycloak:keycloak-services (23.0.0)

org.keycloak:keycloak-services MAVEN version 23.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - fr.cnieg.keycloak:attribute-login-provider 1.3.11 -...

io.apiman:apiman-manager-api-security (>=1.1.4.final, <=1.2.0.final), io.apiman:apiman-manager-ui-hawtio-wildfly8 (>=1.1.4.final, <=1.2.0.final) +148 more potentially affected by CVE-2023-0105 via org.keycloak:keycloak-core (1.2.0.final)

org.keycloak:keycloak-core MAVEN version 1.2.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.apiman:apiman-manager-api-security =1.1.4.final, =1.1.4.final, =0.23.0, =0.23.0, =0.23.0, =0.23.0,...

org.keycloak:keycloak-authz-policy-drools (2.5.0.final), org.keycloak:keycloak-dependencies-server-all (2.5.0.final) +5 more potentially affected by CVE-2023-2422 via org.keycloak:keycloak-services (2.5.0.final)

org.keycloak:keycloak-services MAVEN version 2.5.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 2.5.0.final -...

com.avast.grpc.jwt:grpc-java-jwt-keycloak (>=0.5.3, <=0.5.4), com.github.vzakharchenko:chillispot-radius-plugin (1.3.19) +96 more potentially affected by CVE-2023-1664 via org.keycloak:keycloak-core (16.1.1)

org.keycloak:keycloak-core MAVEN version 16.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.avast.grpc.jwt:grpc-java-jwt-keycloak =0.5.3, =6.2.0, =6.2.0, =6.2.0, =6.0.0, =6.0.0, =6.4.0 and more...

com.canoo.dolphin-platform:dolphin-platform-security-client (>=1.0.0.cr4, <=1.0.0.cr5), com.canoo.dolphin-platform:dolphin-platform-security-server (>=1.0.0.cr4, <=1.0.0.cr5) +88 more potentially affected by CVE-2023-1664 via org.keycloak:keycloak-core (3.4.3.final)

org.keycloak:keycloak-core MAVEN version 3.4.3.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.canoo.dolphin-platform:dolphin-platform-security-client =1.0.0.cr4, =1.0.0.cr4, =1.0.0.cr4,...

io.gravitee.resource:gravitee-resource-oauth2-provider-keycloak (>=1.2.0, <=1.8.0), org.activiti.cloud.audit:activiti-cloud-starter-audit (>=7.0.0.rc2, <=7.1.0.m4) +78 more potentially affected by CVE-2021-3632 via org.keycloak:keycloak-core (4.6.0.final)

org.keycloak:keycloak-core MAVEN version 4.6.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.gravitee.resource:gravitee-resource-oauth2-provider-keycloak =1.2.0, =7.0.0.rc2, =7.0.0.rc2,...

org.keycloak:keycloak-forms (1.0-alpha-1-12062013), org.keycloak:keycloak-model-jpa (1.0-alpha-1-12062013) +4 more potentially affected by CVE-2021-3856 via org.keycloak:keycloak-core (1.0-alpha-1-12062013)

org.keycloak:keycloak-core MAVEN version 1.0-alpha-1-12062013 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-forms 1.0-alpha-1-12062013 - org.keycloak:keycloak-model-jpa...

io.apiman:apiman-distro-wildfly8 (>=1.0.0.beta2, <=1.0.0.final), io.apiman:apiman-manager-ui-war-wildfly8 (>=1.0.0.beta2, <=1.0.2.final) +71 more potentially affected by CVE-2022-0225 via org.keycloak:keycloak-core (1.1.0.beta2)

org.keycloak:keycloak-core MAVEN version 1.1.0.beta2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.apiman:apiman-distro-wildfly8 =1.0.0.beta2, =1.0.0.beta2, =1.0.0.beta2, =2.0.16, =2.0.20, =2.2.28 ...

com.github.vzakharchenko:chillispot-radius-plugin (1.3.6), com.github.vzakharchenko:cisco-radius-plugin (1.3.6) +137 more potentially affected by CVE-2020-35509 via org.keycloak:keycloak-core (13.0.0)

org.keycloak:keycloak-core MAVEN version 13.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.3.6 - com.github.vzakharchenko:cisco-radius-plugin 1.3...

io.apiman:apiman-distro-wildfly8 (>=1.0.0.beta2, <=1.0.0.final), io.apiman:apiman-manager-ui-war-wildfly8 (>=1.0.0.beta2, <=1.0.2.final) +71 more potentially affected by CVE-2020-35509 via org.keycloak:keycloak-core (1.1.0.beta2)

org.keycloak:keycloak-core MAVEN version 1.1.0.beta2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.apiman:apiman-distro-wildfly8 =1.0.0.beta2, =1.0.0.beta2, =1.0.0.beta2, =2.0.16, =2.0.20, =2.2.28 ...

com.gitblit.fathom:fathom-security-keycloak (>=0.8.4, <=1.0.1), org.commonjava.indy.embed:indy-embedder (>=1.3.0, <=1.5.0.3) +54 more potentially affected by CVE-2020-35509 via org.keycloak:keycloak-core (1.9.8.final)

org.keycloak:keycloak-core MAVEN version 1.9.8.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.gitblit.fathom:fathom-security-keycloak =0.8.4, =1.3.0, =1.0.0, =1.0.0, =1.0.0, =1.0, =1.1.0,...

com.kurzdigital:keycloak-admin-wrapper (>=0.9.11, <=0.10.3), com.pleosoft:pleosoft-spring-boot-starter (1.0.5-release) +105 more potentially affected by CVE-2020-1724 via org.keycloak:keycloak-core (4.8.3.final)

org.keycloak:keycloak-core MAVEN version 4.8.3.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.kurzdigital:keycloak-admin-wrapper =0.9.11, =1.1.0, =1.2.2, =1.2.2, =7.1.0.m5, =7.1.0.m5,...

org.keycloak:keycloak-adapter-core (2.0.0.cr1), org.keycloak:keycloak-admin-client (2.0.0.cr1) +46 more potentially affected by CVE-2020-1724 via org.keycloak:keycloak-core (2.0.0.cr1)

org.keycloak:keycloak-core MAVEN version 2.0.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-adapter-core 2.0.0.cr1 - org.keycloak:keycloak-admin-client 2.0.0.cr1 -...

org.keycloak:keycloak-dependencies-server-all (1.6.0.final) potentially affected by CVE-2019-14832 via org.keycloak:keycloak-model-jpa (1.6.0.final)

org.keycloak:keycloak-model-jpa MAVEN version 1.6.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-model-jpa and may be impacted: - org.keycloak:keycloak-dependencies-server-all 1.6.0.final Source cves: CVE-2019-14832 Sourc...

io.apiman:apiman-distro-wildfly8 (>=1.0.0.beta2, <=1.0.0.final), io.apiman:apiman-manager-ui-war-wildfly8 (>=1.0.0.beta2, <=1.0.2.final) +71 more potentially affected by CVE-2018-14658 via org.keycloak:keycloak-core (1.1.0.beta2)

org.keycloak:keycloak-core MAVEN version 1.1.0.beta2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.apiman:apiman-distro-wildfly8 =1.0.0.beta2, =1.0.0.beta2, =1.0.0.beta2, =2.0.16, =2.0.20, =2.2.28 ...