Lauritz Holtmann

The issue exists due to insufficient protection of the web page structure in VMware Workspace One, allowing a remote attacker to impact the confidentiality and integrity of protected information. This is a result of a cross-site scripting vulnerability in the VMware Workspace One UEM console, where the console does not validate incoming requests during device enrollment, leading to the rendering of unsanitized input on the user device in response.

A flaw was found in Keycloak, where it is possible to force the server to call out an unverified URL using the OIDC parameter `request uri`. This flaw allows an attacker to use this parameter to execute a Server-side request forgery (SSRF) attack.

A flaw in the data filter of Keycloak allows the processing of data URLs under certain circumstances, enabling an attacker to conduct cross-site scripting or further attacks.

The issue allows remote code execution due to improper configuration of image processing applications, such as ImageMagick or GraphicsMagick. For a successful exploit, the GhostScript binary `gs` must be available on the server system.