A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible because the resources endpoint applies a transformation of the url path to the file path. Only few specific folder hierarchies can be exposed by this flaw

Affected: Maven: org.keycloak:keycloak-parent

A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible because the resources endpoint applies a transformation of the url path to the file path. Only few specific folder hierarchies can be exposed by this flaw

cxf: JMX integration is vulnerable to a MITM attack keycloak: OIDC redirect_uri allows dangerous schemes resulting in potential XSS picketbox: JBoss EAP reload to admin-only mode allows authentication bypass wildfly: XML validation manipulation due to incomplete application of use-grammar-pool-only in xercesImpl xnio: file descriptor leak caused by growing amounts of NIO Selector file handles may lead to DoS keycloak: path traversal in resources keycloak: user can manage resources with just "view-profile" role using new Account Console