FO
Vendor
ForgeRock
26
CVEs
3
On KEV
0
New 30D
Products
AM9.8
Access Management
ForgeRock
12 CVEs1 on KEV0 new
OP9.8
Openam
Forgerock
6 CVEs1 on KEV0 new
AM9.8
Access Management (AM)
ForgeRock
1 CVEs1 on KEV0 new
LC9.8
Ldap Connector
Forgerock
2 CVEs0 on KEV0 new
IM6.1
Identity Manager
Forgerock
1 CVEs0 on KEV0 new
JP9.8
Java Policy Agents
Forgerock
1 CVEs0 on KEV0 new
RC8.1
Racf Connector
Forgerock
1 CVEs0 on KEV0 new
SB7.8
Service Broker
Forgerock
1 CVEs0 on KEV0 new
WP9.8
Web Policy Agents
Forgerock
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2024-25566 | AM Access Management Forgerock | 6.1 | Oct 29 | An Open-Redirect vulnerability exists in PingAM where well-crafted requests may cause improper validation of redirect URLs |
| CVE-2023-0582 | AM Access Management Forgerock | 9.8 | Mar 27 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ForgeRock Access Management allows Authorization Bypass |
| CVE-2022-3748 | AM Access Management Forgerock | 9.8 | Apr 14 | Improper Authorization vulnerability in ForgeRock Inc |
| CVE-2023-1656 | LC Ldap Connector Forgerock | 7.5 | Mar 29 | Cleartext Transmission of Sensitive Information vulnerability in ForgeRock Inc |
| CVE-2023-0511 | JP Java Policy Agents Forgerock | 9.8 | Feb 28 | Relative Path Traversal vulnerability in ForgeRock Access Management Java Policy Agent allows Authentication Bypass. This issue affects Access Management Java Policy Agent: all… |
| CVE-2023-0339 | WP Web Policy Agents Forgerock | 9.8 | Feb 28 | Relative Path Traversal vulnerability in ForgeRock Access Management Web Policy Agent allows Authentication Bypass. This issue affects Access Management Web Policy Agent: all… |
| CVE-2022-24669 | AM Access Management ForgeRock | 6.5 | Oct 27 | Anonymous users can register / de-register for configuration change notifications |
| CVE-2022-24670 | AM Access Management ForgeRock | 6.5 | Oct 27 | Any user can run unrestricted LDAP queries against a configuration endpoint |
| CVE-2022-0143 | LC Ldap Connector Forgerock | 9.8 | Sep 19 | When the LDAP connector is started with StartTLS configured, unauthenticated access is granted |
| CVE-2021-4201 | AM Access Management Forgerock | 9.8 | Feb 14 | Missing access control in ForgeRock Access Management 7.1.0 and earlier versions on all platforms allows remote unauthenticated attackers to hijack sessions, including potentially… |
| CVE-2021-37154 | AM Access Management Forgerock | 9.8 | Aug 25 | In ForgeRock Access Management (AM) before 7.0.2, the SAML2 implementation allows XML injection, potentially enabling a fraudulent SAML 2.0 assertion |
| CVE-2021-37153 | AM Access Management Forgerock | 9.8 | Aug 25 | ForgeRock Access Management (AM) before 7.0.2, when configured with Active Directory as the Identity Store, has an authentication-bypass issue |
| CVE-2021-35464 RansomwareIn wildKEV | AM Access Management Forgerock | 9.8 | Jul 22 | ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability |
| CVE-2021-29156 | OP Openam Forgerock | 7.5 | Mar 25 | ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol |
| CVE-2020-17465 | IM Identity Manager Forgerock | 6.1 | Aug 31 | Dashboards and progressiveProfileForms in ForgeRock Identity Manager before 7.0.0 are vulnerable to stored XSS |
| CVE-2019-3800 | SB Service Broker Forgerock | 7.8 | Aug 5 | CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag |
| CVE-2017-14395 | OP Openam Forgerock | 6.1 | Jun 19 | Auth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctly validate redirect_uri for some… |
| CVE-2017-14394 | AM Access Management Forgerock | 6.1 | Jun 19 | OAuth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctly validate redirect_uri for some… |
| CVE-2018-7272 | AM Access Management Forgerock | 6.5 | Feb 21 | The REST APIs in ForgeRock AM before 5.5.0 include SSOToken IDs as part of the URL, which allows attackers to obtain sensitive information by finding an ID value in a log file |
| CVE-2016-6500 | RC Racf Connector Forgerock | 8.1 | Feb 3 | Unspecified methods in the RACF Connector component before 1.1.1.0 in ForgeRock OpenIDM and OpenICF improperly call the SearchControls constructor with returnObjFlag set to true,… |
| CVE-2016-10097 | OP Openam Forgerock | 7.5 | Jan 2 | XML External Entity (XXE) Vulnerability in /SSOPOST/metaAlias/%realm%/idpv2 in OpenAM - Access Management 10.1.0 allows remote attackers to read arbitrary files via the… |
| CVE-2014-7246 | OP Openam Forgerock | – | Nov 14 | The Core Server in OpenAM 9.5.3 through 9.5.5, 10.0.0 through 10.0.2, 10.1.0-Xpress, and 11.0.0 through 11.0.2, when deployed on a multi-server network, allows remote… |