PI
Product
Pingfederate
15
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 3Medium 8Low 0
Watch
Add Pingfederate to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-40545 | 9.8 | Feb 6 | PingFederate OAuth client_secret_jwt Authentication Bypass Affected: 11.3.0 |
| CVE-2023-37283 | 9.8 | Oct 25 | Authentication Bypass via HTML Form & Identifier First Adapter Affected: 10.3.0 through 10.3.12; 11.1.0 through 11.1.7; 11.2.0 through 11.2.6; 11.3.0 |
| CVE-2021-40329 | 9.8 | Sep 27 | The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain aspects of external password management Affected: before 10.3 |
| CVE-2022-40724 | 8.8 | Apr 25 | Cross-Site Request Forgery on PingFederate Local Identity Profiles Endpoint. Affected: 10.3.0 through 10.3.11; 11.0.0 through 11.0.6; 11.1.0 through 11.1.5; 11.2.0 through 11.2.2 |
| CVE-2023-39219 | 7.5 | Oct 25 | Admin Console Denial of Service via Java class enumeration Affected: 10.3.0 through 10.3.12; 11.1.0 through 11.1.7; 11.2.0 through 11.2.6; 11.3.0 |
| CVE-2021-41770 | 7.5 | Oct 7 | Ping Identity PingFederate before 10.3.1 mishandles pre-parsing validation, leading to an XXE attack that can achieve XML file disclosure Affected: before 10.3.1 |
| CVE-2023-40148 | 6.5 | Apr 10 | PingFederate Server Side Request Forgery vulnerability Affected: 11.0.0 through 11.0.8; 11.1.0 through 11.1.8; 11.2.0 through 11.2.7; 11.3.0 through 11.3.2 |
| CVE-2022-40723 | 6.5 | Apr 25 | Configuration-based MFA Bypass in PingID RADIUS PCV. Affected: 11.1.0 through 11.1.5; 11.2.0 through 11.2.2 |
| CVE-2022-23722 | 6.5 | May 2 | PingFederate Password Reset via Authentication API Mishandling Affected: 9.3.0 before 9.3.3; 10.0.0 before 10.0.12; 10.1.0 before 10.1.9; 10.2.0 before 10.2.7; 10.3.0 before 10.3.4; 9.3.3; +1 more |
| CVE-2021-42000 | 6.5 | Feb 10 | Ping Identity PingFederate Password Reset and Password Change Mishandling with an authentication policy in parallel reset flows Affected: through 9.3.0; 10.0.0 through 10.0.11; 10.1.0 through 10.1.8; 10.2.0 through 10.2.6; 10.3.0 through 10.3.2; 9.3.3; +1 more |
| CVE-2022-40722 | 5.8 | Apr 25 | Misconfiguration of RSA padding for offline MFA in the PingID Adapter for PingFederate. Affected: 11.1.0 through 11.1.5; 11.2.0 through 11.2.2 |
| CVE-2024-22377 | 5.3 | Jul 9 | PingFederate Runtime Node Path Traversal Affected: 10.3.0 through 10.3.13; 11.0.0 through 11.0.9; 11.1.0 through 11.1.9; 11.2.0 through 11.2.8; 11.3.0 through 11.3.4; 12.0.0 |
| CVE-2024-22477 | 4.3 | Jul 9 | PingFederate OIDC Policy Management Editor Cross-Site Scripting Affected: 10.3.0 through 10.3.13; 11.0.0 through 11.0.9; 11.1.0 through 11.1.9; 11.2.0 through 11.2.8; 11.3.0 through 11.3.4; 12.0.0 |
| CVE-2023-34085 | 4.3 | Oct 25 | User Attribute Disclosure via DynamoDB Data Stores Affected: through 11.3.0 |
| CVE-2014-8489 | – | Dec 12 | Open redirect vulnerability in startSSO.ping in the SP Endpoints in Ping Identity PingFederate 6.10.1 allows remote attackers to redirect users to arbitrary web sites and conduct… Affected: 6.10.1 |
Showing 15