PI
Product
PingFederate
14
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 2Medium 7Low 2
Watch
Add PingFederate to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-25573 | 6.9 | Jun 15 | Stored Cross-Site Scripting in Administrative Console Context Affected: 12.1.0 through 12.1.4; 12.0.0 through 12.0.6; 11.3.0 through 11.3.9; 11.2.0 through 11.2.10 |
| CVE-2025-22854 | 6.9 | Jun 15 | Possible thread exhaustion from processing http responses in PingFederate Google Adapter Affected: 1.0.1 before 1.5.2 |
| CVE-2023-40148 | 6.5 | Apr 10 | PingFederate Server Side Request Forgery vulnerability Affected: 11.3.0 through 11.3.2; 11.2.0 through 11.2.7; 11.1.0 through 11.1.8; 11.0.0 through 11.0.8 |
| CVE-2024-22377 | 5.3 | Jul 9 | PingFederate Runtime Node Path Traversal Affected: 11.0.0 through 11.0.9; 11.1.0 through 11.1.9; 11.2.0 through 11.2.8; 11.3.0 through 11.3.4; 12.0.0; 10.3.0 through 10.3.13 |
| CVE-2025-32736 | 4.9 | Aug 10 | PingFederate Administrative Console CSRF weaknesses Affected: 10.0 before 13.1 |
| CVE-2024-22477 | 4.3 | Jul 9 | PingFederate OIDC Policy Management Editor Cross-Site Scripting Affected: 11.0.0 through 11.0.9; 11.1.0 through 11.1.9; 11.2.0 through 11.2.8; 11.3.0 through 11.3.4; 12.0.0; 10.3.0 through 10.3.13 |
| CVE-2023-34085 | 4.3 | Oct 25 | User Attribute Disclosure via DynamoDB Data Stores Affected: 11.3 through 11.3.0 |
Showing 7