Filtered by vendor Forgerock Subscriptions
Filtered by product Access Management Subscriptions
Total 11 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2023-0582 1 Forgerock 1 Access Management 2024-11-21 8.1 High
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ForgeRock Access Management allows Authorization Bypass. This issue affects access management: before 7.3.0, before 7.2.1, before 7.1.4, through 7.0.2.
CVE-2022-3748 1 Forgerock 1 Access Management 2024-11-21 9.8 Critical
Improper Authorization vulnerability in ForgeRock Inc. Access Management allows Authentication Bypass. This issue affects Access Management: from 6.5.0 through 7.2.0.
CVE-2022-24670 1 Forgerock 1 Access Management 2024-11-21 7.1 High
An attacker can use the unrestricted LDAP queries to determine configuration entries
CVE-2022-24669 1 Forgerock 1 Access Management 2024-11-21 6.5 Medium
It may be possible to gain some details of the deployment through a well-crafted attack. This may allow that data to be used to probe internal network services.
CVE-2021-4201 1 Forgerock 1 Access Management 2024-11-21 9.6 Critical
Missing access control in ForgeRock Access Management 7.1.0 and earlier versions on all platforms allows remote unauthenticated attackers to hijack sessions, including potentially admin-level sessions. This issue affects: ForgeRock Access Management 7.1 versions prior to 7.1.1; 6.5 versions prior to 6.5.4; all previous versions.
CVE-2021-37154 1 Forgerock 1 Access Management 2024-11-21 9.8 Critical
In ForgeRock Access Management (AM) before 7.0.2, the SAML2 implementation allows XML injection, potentially enabling a fraudulent SAML 2.0 assertion.
CVE-2021-37153 1 Forgerock 1 Access Management 2024-11-21 9.8 Critical
ForgeRock Access Management (AM) before 7.0.2, when configured with Active Directory as the Identity Store, has an authentication-bypass issue.
CVE-2018-7272 1 Forgerock 1 Access Management 2024-11-21 N/A
The REST APIs in ForgeRock AM before 5.5.0 include SSOToken IDs as part of the URL, which allows attackers to obtain sensitive information by finding an ID value in a log file.
CVE-2017-14395 1 Forgerock 2 Access Management, Openam 2024-11-21 N/A
Auth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctly validate redirect_uri for some invalid requests, which allows attackers to execute a script in the user's browser via reflected XSS.
CVE-2017-14394 1 Forgerock 2 Access Management, Openam 2024-11-21 N/A
OAuth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctly validate redirect_uri for some invalid requests, which allows attackers to perform phishing via an unvalidated redirect.
CVE-2024-25566 1 Forgerock 1 Access Management 2024-11-08 6.1 Medium
An Open-Redirect vulnerability exists in PingAM where well-crafted requests may cause improper validation of redirect URLs. This could allow an attacker to redirect end-users to malicious sites under their control, simplifying phishing attacks