Browse CVEs

MEDIUM 5.3 CVE-2024-22377 The deploy directory in PingFederate runtime nodes is reachable to unauthorized users. Pingfederate after 11.3.4 Fix from $1,6002024-07-09 CRITICAL 9.8 CVE-2023-40545 Authentication bypass when an OAuth2 Client is using client_secret_jwt as its authentication method on affected 11.3 versions via specially crafted r… Pingfederate Mitigation only Fix from $2,3002024-02-06 HIGH 8.8 CVE-2023-36496 Delegated Admin Privilege virtual attribute provider plugin, when enabled, allows an authenticated user to elevate their permissions in the Directory… Pingdirectory after 9.1.0.2 Fix from $1,9502024-02-01 CRITICAL 9.8 CVE-2023-39930 A first-factor authentication bypass vulnerability exists in the PingFederate with PingID Radius PCV when a MSCHAP authentication request is sent via… Pingid Radius Pcv 3.0.3+ Fix from $2,3002023-10-25 MEDIUM 6.5 CVE-2023-39231 PingFederate using the PingOne MFA adapter allows a new MFA device to be paired without requiring second factor authentication from an existing regis… Pingone Mfa Integration Kit Mitigation only Fix from $1,6002023-10-25 CRITICAL 9.8 CVE-2023-37283 Under a very specific and highly unrecommended configuration, authentication bypass is possible in the PingFederate Identifier First Adapter Pingfederate after 11.2.6 Fix from $2,3002023-10-25 HIGH 7.5 CVE-2023-39219 PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java class loading enumeration req… Pingfederate after 11.2.6 Fix from $1,9502023-10-25 HIGH 8.8 CVE-2022-40724 The PingFederate Local Identity Profiles '/pf/idprofile.ping' endpoint is vulnerable to Cross-Site Request Forgery (CSRF) through crafted GET request… Pingfederate after 11.2.2 Fix from $1,9502023-04-25 MEDIUM 6.5 CVE-2022-40723 The PingID RADIUS PCV adapter for PingFederate, which supports RADIUS authentication with PingID MFA, is vulnerable to MFA bypass under certain confi… Pingfederate 2.24 / 3.0.2+ Fix from $1,6002023-04-25 MEDIUM 6.1 CVE-2022-40725 PingID Desktop prior to the latest released version 1.7.4 contains a vulnerability that can be exploited to bypass the maximum PIN attempts permitted… Desktop 1.7.4+ Fix from $1,6002023-04-25 MEDIUM 5.8 CVE-2022-40722 A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vuln… Pingfederate 2.13.2 / 2.24+ Fix from $1,6002023-04-25 MEDIUM 6.1 CVE-2018-25084 A vulnerability, which was classified as problematic, has been found in Ping Identity Self-Service Account Manager 1.1.2. Affected by this issue is s… Self Service Account Manager Patch available Fix from $1,6002023-04-10 HIGH 8.2 CVE-2022-23720 PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file. An IT… Pingid Integration For Windows Login 2.8+ Fix from $1,9502022-06-30 HIGH 8.1 CVE-2022-23718 PingID Windows Login prior to 2.8 uses known vulnerable components that can lead to remote code execution. An attacker capable of achieving a sophist… Pingid Integration For Windows Login 2.8+ Fix from $1,9502022-06-30 HIGH 7.5 CVE-2021-41995 A misconfiguration of RSA in PingID Mac Login prior to 1.1 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass. Pingid Integration For Mac Login 1.1+ Fix from $1,9502022-06-30 MEDIUM 6.4 CVE-2022-23719 PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requests. An attacker wi… Pingid Integration For Windows Login 2.8+ Fix from $1,6002022-06-30 MEDIUM 5.5 CVE-2022-23717 PingID Windows Login prior to 2.8 is vulnerable to a denial of service condition on local machines when combined with using offline security keys as … Pingid Integration For Windows Login 2.8+ Fix from $1,6002022-06-30 MEDIUM 5.5 CVE-2022-23725 PingID Windows Login prior to 2.8 does not properly set permissions on the Windows Registry entries used to store sensitive API keys under some circu… Pingid Integration For Windows Login 2.8+ Fix from $1,6002022-06-30 HIGH 8.1 CVE-2022-23724 Use of static encryption key material allows forging an authentication token to other users within a tenant organization. MFA may be bypassed by redi… Pingid Integration For Windows Login 2.4.2+ Fix from $1,9502022-05-04 HIGH 7.7 CVE-2022-23723 An MFA bypass vulnerability exists in the PingFederate PingOne MFA Integration Kit when adapter HTML templates are used as part of an authentication … Pingone Mfa Integration Kit Mitigation only Fix from $1,9502022-05-02 MEDIUM 6.5 CVE-2022-23722 When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID or SMS aut… Pingfederate 9.3.3 / 10.0.12+ Fix from $1,6002022-05-02 CRITICAL 9.9 CVE-2021-42001 PingID Desktop prior to 1.7.3 has a misconfiguration in the encryption libraries which can lead to sensitive data exposure. An attacker capable of ex… Pingid Desktop 1.7.3+ Fix from $2,3002022-04-30 MEDIUM 5.6 CVE-2021-41992 A misconfiguration of RSA in PingID Windows Login prior to 2.7 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass. Pingid Integration For Windows Login 2.7+ Fix from $1,6002022-04-30 MEDIUM 6.5 CVE-2021-42000 When a password reset or password change flow with an authentication policy is configured and the adapter in the reset or change policy supports mult… Pingfederate after 10.3.2 Fix from $1,6002022-02-10 HIGH 7.5 CVE-2021-41770 Ping Identity PingFederate before 10.3.1 mishandles pre-parsing validation, leading to an XXE attack that can achieve XML file disclosure. Pingfederate 10.3.1+ Fix from $1,9502021-10-07 CRITICAL 9.8 CVE-2021-40329 The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain aspects of external password management. Pingfederate 10.3+ Fix from $2,3002021-09-27 MEDIUM 5.3 CVE-2021-31923 Ping Identity PingAccess before 5.3.3 allows HTTP request smuggling via header manipulation. Pingaccess 5.3.3+ Fix from $1,6002021-09-24 HIGH 7.5 CVE-2021-39270 In Ping Identity RSA SecurID Integration Kit before 3.2, user impersonation can occur. Rsa Securid Integration Kit 3.2+ Fix from $1,9502021-08-18 HIGH 7.8 CVE-2020-25826 PingID Integration for Windows Login before 2.4.2 allows local users to gain privileges by modifying CefSharp.BrowserSubprocess.exe. Pingid Integration For Windows Login 2.4.2+ Fix from $1,9502020-09-23 CRITICAL 9.8 CVE-2020-10654 Ping Identity PingID SSH before 4.0.14 contains a heap buffer overflow in PingID-enrolled servers. This condition can be potentially exploited into a… Pingid Ssh Integration 4.0.14+ Fix from $2,3002020-05-13