RSS   Vulnerabilities for 'Openam'   RSS

2021-03-25
 
CVE-2021-29156

CWE-74
 

 
ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attacker can perform character-by-character retrieval of password hashes, or retrieve a session token or a private key.

 
2017-01-02
 
CVE-2016-10097

 

 
XML External Entity (XXE) Vulnerability in /SSOPOST/metaAlias/%realm%/idpv2 in OpenAM - Access Management 10.1.0 allows remote attackers to read arbitrary files via the SAMLRequest parameter.

 
2014-11-13
 
CVE-2014-7246

CWE-20
 

 
The Core Server in OpenAM 9.5.3 through 9.5.5, 10.0.0 through 10.0.2, 10.1.0-Xpress, and 11.0.0 through 11.0.2, when deployed on a multi-server network, allows remote authenticated users to cause a denial of service (infinite loop) via a crafted cookie in a request.

 

 >>> Vendor: Forgerock 4 Products
Openam
Racf connector
Identity manager
Access management


Copyright 2022, cxsecurity.com

 

Back to Top