Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
pingidentity pingfederate vulnerabilities and exploits
(subscribe to this query)
6.5
CVSSv3
CVE-2022-23722
When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID or SMS authentication, an existing user can reset another existing user’s password.
Pingidentity Pingfederate 9.3.3
Pingidentity Pingfederate
Pingidentity Pingfederate 11.0.0
9.8
CVSSv3
CVE-2023-37283
Under a very specific and highly unrecommended configuration, authentication bypass is possible in the PingFederate Identifier First Adapter
Pingidentity Pingfederate 11.3.0
Pingidentity Pingfederate
7.5
CVSSv3
CVE-2023-39219
PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java class loading enumeration requests
Pingidentity Pingfederate 11.3.0
Pingidentity Pingfederate
6.5
CVSSv3
CVE-2021-42000
When a password reset or password change flow with an authentication policy is configured and the adapter in the reset or change policy supports multiple parallel reset flows, an existing user can reset another existing users password.
Pingidentity Pingfederate
Pingidentity Pingfederate 9.3.3
5.8
CVSSv3
CVE-2022-40722
A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA.
Pingidentity Pingid Integration Kit
Pingidentity Pingfederate
Pingidentity Pingid Adapter For Pingfederate
4.3
CVSSv3
CVE-2023-34085
When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request
Pingidentity Pingfederate
9.8
CVSSv3
CVE-2021-40329
The Authentication API in Ping Identity PingFederate prior to 10.3 mishandles certain aspects of external password management.
Pingidentity Pingfederate
7.5
CVSSv3
CVE-2021-41770
Ping Identity PingFederate prior to 10.3.1 mishandles pre-parsing validation, leading to an XXE attack that can achieve XML file disclosure.
Pingidentity Pingfederate
8.8
CVSSv3
CVE-2022-40724
The PingFederate Local Identity Profiles '/pf/idprofile.ping' endpoint is vulnerable to Cross-Site Request Forgery (CSRF) through crafted GET requests.
Pingidentity Pingfederate
9.8
CVSSv3
CVE-2023-40545
Authentication bypass when an OAuth2 Client is using client_secret_jwt as its authentication method on affected 11.3 versions via specially crafted requests.
Pingidentity Pingfederate 11.3.0
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-4367
CVE-2024-3611
CVE-2024-4947
CVE-2024-32988
CVE-2020-35165
local file inclusion
CVE-2024-4980
bypass
malicious code
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
NEXT »