Lauritz Holtmann

**Name of the Vulnerable Software and Affected Versions** VMware Workspace One versions 20.1.0.0 through 20.1.0.31 VMware Workspace One versions 20.3.0.0 through 20.3.0.22 VMware Workspace One versions 20.4.0.0 through 20.4.0.20 VMware Workspace One versions 20.5.0.0 through 20.5.0.45 VMware Workspace One versions 20.6.0.0 through 20.6.0.18 VMware Workspace One versions 20.7.0.0 through 20.7.0.13 VMware Workspace One versions 20.8.0.0 through 20.8.0.27 VMware Workspace One versions 20.10.0.0 through 20.10.0.15 VMware Workspace One versions 20.11.0.0 through 20.11.0.26 VMware Workspace One versions 21.1.0.0 through 21.1.0.13 VMware Workspace One versions 21.2.0.0 through 21.2.0.7 **Description** The issue exists due to insufficient protection of the web page structure in VMware Workspace One, allowing a remote attacker to impact the confidentiality and integrity of protected information. This is a result of a cross-site scripting vulnerability in the VMware Workspace One UEM console, where the console does not validate incoming requests during device enrollment, leading to the rendering of unsanitized input on the user device in response. **Recommendations** For versions 20.1.0.0 through 20.1.0.31, update to version 20.1.0.32 or later. For versions 20.3.0.0 through 20.3.0.22, update to version 20.3.0.23 or later. For versions 20.4.0.0 through 20.4.0.20, update to version 20.4.0.21 or later. For versions 20.5.0.0 through 20.5.0.45, update to version 20.5.0.46 or later. For versions 20.6.0.0 through 20.6.0.18, update to version 20.6.0.19 or later. For versions 20.7.0.0 through 20.7.0.13, update to version 20.7.0.14 or later. For versions 20.8.0.0 through 20.8.0.27, update to version 20.8.0.28 or later. For versions 20.10.0.0 through 20.10.0.15, update to version 20.10.0.16 or later. For versions 20.11.0.0 through 20.11.0.26, update to version 20.11.0.27 or later. For versions 21.1.0.0 through 21.1.0.13, update to version 21.1.0.14 or later. For versions 21.2.0.0 through 21.2.0.7, update to version 21.2.0.8 or later.

**Name of the Vulnerable Software and Affected Versions** Keycloak versions prior to 13.0.0 **Description** A flaw was found in Keycloak, where it is possible to force the server to call out an unverified URL using the OIDC parameter `request uri`. This flaw allows an attacker to use this parameter to execute a Server-side request forgery (SSRF) attack. **Recommendations** For versions prior to 13.0.0, update to version 13.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the `request uri` parameter in the OIDC endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Keycloak version 10.0.1 **Description** A flaw in the data filter of Keycloak allows the processing of data URLs under certain circumstances, enabling an attacker to conduct cross-site scripting or further attacks. **Recommendations** For version 10.0.1, consider disabling the data filter functionality until a patch is available to prevent the processing of malicious data URLs.

**Name of the Vulnerable Software and Affected Versions** TYPO3 versions 8.x through 8.7.24 TYPO3 versions 9.x through 9.5.5 **Description** The issue allows remote code execution due to improper configuration of image processing applications, such as ImageMagick or GraphicsMagick. For a successful exploit, the GhostScript binary `gs` must be available on the server system. **Recommendations** For TYPO3 versions 8.x through 8.7.24, update to version 8.7.25 or later. For TYPO3 versions 9.x through 9.5.5, update to version 9.5.6 or later.