Andrej Tomci

**Name of the Vulnerable Software and Affected Versions** Apache ActiveMQ Client versions prior to 5.19.8 Apache ActiveMQ Client versions 6.0.0 through 6.2.6 Apache ActiveMQ versions prior to 5.19.8 Apache ActiveMQ versions 6.0.0 through 6.2.6 Apache ActiveMQ All versions prior to 5.19.8 Apache ActiveMQ All versions 6.0.0 through 6.2.6 **Description** An unauthenticated network attacker can cause a broker Denial of Service (DoS) by sending a crafted WireFormatInfo frame containing a malicious large size value. Because this value is not validated, the broker attempts a memory allocation during pre-authentication negotiation, which can trigger an Out of Memory (OOM) condition and crash the broker. **Recommendations** Upgrade Apache ActiveMQ Client versions prior to 5.19.8 to version 5.19.8. Upgrade Apache ActiveMQ Client versions 6.0.0 through 6.2.6 to version 6.2.7. Upgrade Apache ActiveMQ versions prior to 5.19.8 to version 5.19.8. Upgrade Apache ActiveMQ versions 6.0.0 through 6.2.6 to version 6.2.7. Upgrade Apache ActiveMQ All versions prior to 5.19.8 to version 5.19.8. Upgrade Apache ActiveMQ All versions 6.0.0 through 6.2.6 to version 6.2.7.

**Name of the Vulnerable Software and Affected Versions** Keycloak (affected versions not specified) **Description** A flaw exists in the Fine-Grained Admin Permissions (FGAPv2) feature. An administrator with limited client management permissions can assign any realm role, including highly privileged ones, to a client's scope mapping. This bypasses security controls, allowing the injected role to be included in a user's authentication token upon accessing the modified client, which can result in unauthorized privilege escalation within the realm. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.