Drak3Hft7

**Name of the Vulnerable Software and Affected Versions** Keycloak (affected versions not specified) **Description** An issue exists in Keycloak where an authenticated user possessing the `view-users` role can access and retrieve user attributes intended to be hidden. This occurs through exploitation of a flaw within the `UserResource` component by accessing a specific administrative endpoint. This unauthorized access leads to information disclosure of sensitive user data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenProject versions prior to 17.2.0 **Description** OpenProject is a web-based project management software. Prior to version 17.2.0, the SMTP test endpoint, accessible via the ''POST /admin/settings/mail notifications'' API endpoint, accepts arbitrary host and port values. This allows an attacker with access to map internal hosts and identify reachable services and ports through timing and error differences in the response. Similarly, creating webhooks pointing to arbitrary IPs results in a Server-Side Request Forgery (SSRF) issue, enabling attackers to scan the internal network. The `host` and `port` parameters of the SMTP test endpoint are vulnerable. **Recommendations** Versions prior to 17.2.0 should be updated to version 17.2.0 or later.