CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-40545 – PingFederate OAuth client_secret_jwt Authentication Bypass
https://notcve.org/view.php?id=CVE-2023-40545
06 Feb 2024 — Authentication bypass when an OAuth2 Client is using client_secret_jwt as its authentication method on affected 11.3 versions via specially crafted requests. Omisión de autenticación cuando un cliente OAuth2 utiliza client_secret_jwt como método de autenticación en las versiones 11.3 afectadas a través de solicitudes especialmente manipuladas. Authentication bypass when an OAuth2 Client is using client_secret_jwt as its authentication method on affected 11.3 versions via specially crafted requests. • https://docs.pingidentity.com/r/en-us/pingfederate-113/hro1701116403236 • CWE-306: Missing Authentication for Critical Function •
CVSS: 9.0EPSS: 0%CPEs: 7EXPL: 0CVE-2023-36496 – Delegated Admin Virtual Attribute Provider Privilege Escalation
https://notcve.org/view.php?id=CVE-2023-36496
01 Feb 2024 — Delegated Admin Privilege virtual attribute provider plugin, when enabled, allows an authenticated user to elevate their permissions in the Directory Server. El complemento del proveedor de atributos virtuales Delegated Admin Privilege, cuando está habilitado, permite a un usuario autenticado elevar sus permisos en Directory Server. • https://docs.pingidentity.com/r/en-us/pingdirectory-93/ynf1693338390284 • CWE-269: Improper Privilege Management •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-34085 – User Attribute Disclosure via DynamoDB Data Stores
https://notcve.org/view.php?id=CVE-2023-34085
25 Oct 2023 — When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request Cuando se utiliza una tabla de AWS DynamoDB para el almacenamiento de atributos de usuario, es posible recuperar los atributos de otro usuario mediante una solicitud manipulada con fines malintencionados. • https://docs.pingidentity.com/r/en-us/pingfederate-113/gyk1689105783244 • CWE-359: Exposure of Private Personal Information to an Unauthorized Actor •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2023-39219 – Admin Console Denial of Service via Java class enumeration
https://notcve.org/view.php?id=CVE-2023-39219
25 Oct 2023 — PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java class loading enumeration requests La dependencia de la consola administrativa de PingFederate contiene una debilidad donde la consola deja de responder con solicitudes de enumeración de carga de clases Java manipuladas • https://docs.pingidentity.com/r/en-us/pingfederate-113/gyk1689105783244 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 10.0EPSS: 0%CPEs: 4EXPL: 0CVE-2023-37283 – Authentication Bypass via HTML Form & Identifier First Adapter
https://notcve.org/view.php?id=CVE-2023-37283
25 Oct 2023 — Under a very specific and highly unrecommended configuration, authentication bypass is possible in the PingFederate Identifier First Adapter Bajo una configuración muy específica y altamente no recomendada, la omisión de autenticación es posible en PingFederate Identifier First Adapter • https://docs.pingidentity.com/r/en-us/pingfederate-113/gyk1689105783244 • CWE-287: Improper Authentication •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-39930 – PingFederate PingID Radius PCV Authentication Bypass
https://notcve.org/view.php?id=CVE-2023-39930
24 Oct 2023 — A first-factor authentication bypass vulnerability exists in the PingFederate with PingID Radius PCV when a MSCHAP authentication request is sent via a maliciously crafted RADIUS client request. Existe una vulnerabilidad de omisión de autenticación de primer factor en PingFederate con PingID Radius PCV cuando se envía una solicitud de autenticación MSCHAP a través de una solicitud de cliente RADIUS manipulada con fines malintencionados. • https://docs.pingidentity.com/r/en-us/pingid/pingid_integration_kit_2_26_rn • CWE-288: Authentication Bypass Using an Alternate Path or Channel CWE-306: Missing Authentication for Critical Function •
CVSS: 7.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-39231 – PingFederate PingOne MFA IK Device Pairing Second Factor Authentication Bypass
https://notcve.org/view.php?id=CVE-2023-39231
24 Oct 2023 — PingFederate using the PingOne MFA adapter allows a new MFA device to be paired without requiring second factor authentication from an existing registered device. A threat actor may be able to exploit this vulnerability to register their own MFA device if they have knowledge of a victim user's first factor credentials. PingFederate utilizando el adaptador PingOne MFA permite emparejar un nuevo dispositivo MFA sin requerir autenticación de segundo factor de un dispositivo registrado existente. Un actor de am... • https://docs.pingidentity.com/r/en-us/pingfederate-pingone-mfa-ik/bks1657303194394 • CWE-288: Authentication Bypass Using an Alternate Path or Channel CWE-306: Missing Authentication for Critical Function •
CVSS: 3.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-23721 – PingID integration for Windows login duplicate username collision.
https://notcve.org/view.php?id=CVE-2022-23721
25 Apr 2023 — PingID integration for Windows login prior to 2.9 does not handle duplicate usernames, which can lead to a username collision when two people with the same username are provisioned onto the same machine at different times. • https://docs.pingidentity.com/r/en-us/pingid/davinci_pingid_windows_login_relnotes_2.9 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-694: Use of Multiple Resources with Duplicate Identifier •
CVSS: 7.7EPSS: 0%CPEs: 4EXPL: 0CVE-2022-40722 – Misconfiguration of RSA padding for offline MFA in the PingID Adapter for PingFederate.
https://notcve.org/view.php?id=CVE-2022-40722
25 Apr 2023 — A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA. • https://docs.pingidentity.com/r/en-us/pingid/pingid_adapter_configuring_offline_mfa • CWE-327: Use of a Broken or Risky Cryptographic Algorithm CWE-780: Use of RSA Algorithm without OAEP •
CVSS: 6.8EPSS: 0%CPEs: 5EXPL: 0CVE-2022-40723 – Configuration-based MFA Bypass in PingID RADIUS PCV.
https://notcve.org/view.php?id=CVE-2022-40723
25 Apr 2023 — The PingID RADIUS PCV adapter for PingFederate, which supports RADIUS authentication with PingID MFA, is vulnerable to MFA bypass under certain configurations. • https://docs.pingidentity.com/r/en-us/pingid/pingid_integration_kit_2_19_rn • CWE-287: Improper Authentication CWE-305: Authentication Bypass by Primary Weakness •