Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
forgerock access management vulnerabilities and exploits
(subscribe to this query)
10
CVSSv2
CVE-2021-37154
In ForgeRock Access Management (AM) prior to 7.0.2, the SAML2 implementation allows XML injection, potentially enabling a fraudulent SAML 2.0 assertion.
Forgerock Access Management
10
CVSSv2
CVE-2021-35464
ForgeRock AM server prior to 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/* request to the serv...
Forgerock Am
Forgerock Openam
1 Github repository
7.5
CVSSv2
CVE-2021-4201
Missing access control in ForgeRock Access Management 7.1.0 and previous versions versions on all platforms allows remote unauthenticated malicious users to hijack sessions, including potentially admin-level sessions. This issue affects: ForgeRock Access Management 7.1 versions b...
Forgerock Access Management 5.5.2
Forgerock Access Management 6.0.0
Forgerock Access Management 6.0.0.1
Forgerock Access Management 6.0.0.2
Forgerock Access Management 6.0.0.3
Forgerock Access Management 6.0.0.4
Forgerock Access Management 6.0.0.6
Forgerock Access Management 6.0.0.7
Forgerock Access Management 6.5.0
Forgerock Access Management 6.5.0.1
Forgerock Access Management 6.5.0.2
Forgerock Access Management 6.5.1
Forgerock Access Management 6.5.2.1
Forgerock Access Management 6.5.2.2
Forgerock Access Management 6.5.2.3
Forgerock Access Management 6.5.3
Forgerock Access Management 7.0.0
Forgerock Access Management 7.0.1
Forgerock Access Management 7.0.2
Forgerock Access Management 7.1.0
7.5
CVSSv2
CVE-2021-37153
ForgeRock Access Management (AM) prior to 7.0.2, when configured with Active Directory as the Identity Store, has an authentication-bypass issue.
Forgerock Access Management
5.8
CVSSv2
CVE-2017-14394
OAuth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctly validate redirect_uri for some invalid requests, which allows malicious users to perform phishing via an unvalidated redirect.
Forgerock Access Management
Forgerock Openam
5
CVSSv2
CVE-2016-10097
XML External Entity (XXE) Vulnerability in /SSOPOST/metaAlias/%realm%/idpv2 in OpenAM - Access Management 10.1.0 allows remote malicious users to read arbitrary files via the SAMLRequest parameter.
Forgerock Openam 10.1.0
4.3
CVSSv2
CVE-2017-14395
Auth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctly validate redirect_uri for some invalid requests, which allows malicious users to execute a script in the user's browser via reflected...
Forgerock Access Management
Forgerock Openam
4
CVSSv2
CVE-2018-7272
The REST APIs in ForgeRock AM prior to 5.5.0 include SSOToken IDs as part of the URL, which allows malicious users to obtain sensitive information by finding an ID value in a log file.
Forgerock Access Management
NA
CVE-2023-0582
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ForgeRock Access Management allows Authorization Bypass. This issue affects access management: prior to 7.3.0, prior to 7.2.1, prior to 7.1.4, up to and including 7.0.2.
NA
CVE-2022-3748
Improper Authorization vulnerability in ForgeRock Inc. Access Management allows Authentication Bypass. This issue affects Access Management: from 6.5.0 up to and including 7.2.0.
Forgerock Access Management
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-29895
blind SQL injection
CVE-2024-5064
CVE-2023-52677
CVE-2023-52682
CVE-2024-30051
CVE-2024-35849
remote attackers
remote
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
NEXT »