Vulmon
Recent Vulnerabilities
Product List
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
pingidentity pingfederate vulnerabilities and exploits
(subscribe to this query)
6.5
CVSSv3
CVE-2022-23722
When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID or SMS authentication, an existing user can reset another existing user’s password.
Pingidentity Pingfederate 9.3.3
Pingidentity Pingfederate
Pingidentity Pingfederate 11.0.0
9.8
CVSSv3
CVE-2023-37283
Under a very specific and highly unrecommended configuration, authentication bypass is possible in the PingFederate Identifier First Adapter
Pingidentity Pingfederate 11.3.0
Pingidentity Pingfederate
7.5
CVSSv3
CVE-2023-39219
PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java class loading enumeration requests
Pingidentity Pingfederate 11.3.0
Pingidentity Pingfederate
6.5
CVSSv3
CVE-2021-42000
When a password reset or password change flow with an authentication policy is configured and the adapter in the reset or change policy supports multiple parallel reset flows, an existing user can reset another existing users password.
Pingidentity Pingfederate
Pingidentity Pingfederate 9.3.3
5.8
CVSSv3
CVE-2022-40722
A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA.
Pingidentity Pingid Integration Kit
Pingidentity Pingfederate
Pingidentity Pingid Adapter For Pingfederate
4.3
CVSSv3
CVE-2023-34085
When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request
Pingidentity Pingfederate
7.5
CVSSv3
CVE-2021-41770
Ping Identity PingFederate prior to 10.3.1 mishandles pre-parsing validation, leading to an XXE attack that can achieve XML file disclosure.
Pingidentity Pingfederate
9.8
CVSSv3
CVE-2021-40329
The Authentication API in Ping Identity PingFederate prior to 10.3 mishandles certain aspects of external password management.
Pingidentity Pingfederate
8.8
CVSSv3
CVE-2022-40724
The PingFederate Local Identity Profiles '/pf/idprofile.ping' endpoint is vulnerable to Cross-Site Request Forgery (CSRF) through crafted GET requests.
Pingidentity Pingfederate
6.5
CVSSv3
CVE-2022-40723
The PingID RADIUS PCV adapter for PingFederate, which supports RADIUS authentication with PingID MFA, is vulnerable to MFA bypass under certain configurations.
Pingidentity Pingid Integration Kit
Pingidentity Pingfederate
Pingidentity Radius Pcv 2.10.0
Pingidentity Radius Pcv
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-0044
client side
CVE-2021-47601
deserialization
CVE-2024-34994
encryption
CVE-2021-47609
CVE-2024-37079
CVE-2024-38608
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
NEXT »