forgerock am vulnerabilities and exploits

(subscribe to this query)

9.8

CVSSv3

ForgeRock Access Management (AM) prior to 7.0.2, when configured with Active Directory as the Identity Store, has an authentication-bypass issue.

Forgerock Access Management

9.8

CVSSv3

In ForgeRock Access Management (AM) prior to 7.0.2, the SAML2 implementation allows XML injection, potentially enabling a fraudulent SAML 2.0 assertion.

Forgerock Access Management

9.8

CVSSv3

ForgeRock AM server prior to 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/* request to the serv...

Forgerock Am Forgerock Openam

1 Github repository

6.5

CVSSv3

The REST APIs in ForgeRock AM prior to 5.5.0 include SSOToken IDs as part of the URL, which allows malicious users to obtain sensitive information by finding an ID value in a log file.

Forgerock Access Management

6.1

CVSSv3

OAuth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctly validate redirect_uri for some invalid requests, which allows malicious users to perform phishing via an unvalidated redirect.

Forgerock Access Management Forgerock Openam

6.1

CVSSv3

Auth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctly validate redirect_uri for some invalid requests, which allows malicious users to execute a script in the user's browser via reflected...

Forgerock Access Management Forgerock Openam

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook