
CVE-2024-23983 – Access rules for PingAccess may be circumvented with URL-encoded characters
https://notcve.org/view.php?id=CVE-2024-23983
11 Nov 2024 — Improper handling of canonical URL-encoding may lead to bypass not properly constrained by request rules. • https://docs.pingidentity.com/pingaccess/latest/release_notes/pa_811_rn.html • CWE-20: Improper Input Validation CWE-177: Improper Handling of URL Encoding (Hex Encoding) •

CVE-2024-23316 – PingAccess HTTP Request Desynchronization Weakness
https://notcve.org/view.php?id=CVE-2024-23316
31 May 2024 — HTTP request desynchronization in Ping Identity PingAccess, all versions prior to 8.0.1 affected allows an attacker to send specially crafted http header requests to create a request smuggling condition for proxied requests. La desincronización de solicitudes HTTP en Ping Identity PingAccess, todas las versiones anteriores a 8.0.1 afectadas, permite a un atacante enviar solicitudes de encabezado http especialmente manipuladas para crear una condición de contrabando de solicitudes para solicitudes proxy. • https://docs.pingidentity.com/r/en-us/pingaccess-80/pa_801_rn • CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') •