pingidentity pingfederate vulnerabilities and exploits

(subscribe to this query)

312

VMScore

When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID or SMS authentication, an existing user can reset another existing user’s password.

Pingidentity Pingfederate 9.3.3 Pingidentity Pingfederate Pingidentity Pingfederate 11.0.0

NA

PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java class loading enumeration requests

Pingidentity Pingfederate 11.3.0 Pingidentity Pingfederate

312

VMScore

When a password reset or password change flow with an authentication policy is configured and the adapter in the reset or change policy supports multiple parallel reset flows, an existing user can reset another existing users password.

Pingidentity Pingfederate Pingidentity Pingfederate 9.3.3

NA

Under a very specific and highly unrecommended configuration, authentication bypass is possible in the PingFederate Identifier First Adapter

Pingidentity Pingfederate 11.3.0 Pingidentity Pingfederate

NA

A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA.

Pingidentity Pingid Integration Kit Pingidentity Pingfederate Pingidentity Pingid Adapter For Pingfederate

668

VMScore

The Authentication API in Ping Identity PingFederate prior to 10.3 mishandles certain aspects of external password management.

Pingidentity Pingfederate

NA

The PingFederate Local Identity Profiles '/pf/idprofile.ping' endpoint is vulnerable to Cross-Site Request Forgery (CSRF) through crafted GET requests.

Pingidentity Pingfederate

NA

When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request

Pingidentity Pingfederate

445

VMScore

Ping Identity PingFederate prior to 10.3.1 mishandles pre-parsing validation, leading to an XXE attack that can achieve XML file disclosure.

Pingidentity Pingfederate

570

VMScore

Open redirect vulnerability in startSSO.ping in the SP Endpoints in Ping Identity PingFederate 6.10.1 allows remote malicious users to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the TargetResource parameter.

Pingidentity Pingfederate 6.10.1

Get Started

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook