5 results (0.004 seconds)

CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0

CVE-2023-34085 – User Attribute Disclosure via DynamoDB Data Stores

https://notcve.org/view.php?id=CVE-2023-34085

When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request Cuando se utiliza una tabla de AWS DynamoDB para el almacenamiento de atributos de usuario, es posible recuperar los atributos de otro usuario mediante una solicitud manipulada con fines malintencionados. • https://docs.pingidentity.com/r/en-us/pingfederate-113/gyk1689105783244 https://www.pingidentity.com/en/resources/downloads/pingfederate.html • CWE-359: Exposure of Private Personal Information to an Unauthorized Actor •

CVSS: 6.5EPSS: 0%CPEs: 7EXPL: 0

CVE-2021-42000 – Ping Identity PingFederate Password Reset and Password Change Mishandling with an authentication policy in parallel reset flows

https://notcve.org/view.php?id=CVE-2021-42000

When a password reset or password change flow with an authentication policy is configured and the adapter in the reset or change policy supports multiple parallel reset flows, an existing user can reset another existing users password. Cuando es configurado un flujo de restablecimiento o cambio de contraseña con una política de autenticación y el adaptador de la política de restablecimiento o cambio admite varios flujos de restablecimiento paralelos, un usuario existente puede restablecer la contraseña de otro usuario existente • https://docs.pingidentity.com/bundle/pingfederate-103/page/hhm1634833631515.html https://www.pingidentity.com/en/resources/downloads/pingfederate.html • CWE-285: Improper Authorization •

CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0

CVE-2021-41770

https://notcve.org/view.php?id=CVE-2021-41770

Ping Identity PingFederate before 10.3.1 mishandles pre-parsing validation, leading to an XXE attack that can achieve XML file disclosure. Ping Identity PingFederate versiones anteriores a 10.3.1, maneja inapropiadamente la comprobación de preanálisis, conllevando a un ataque de tipo XXE que puede lograr una divulgación de archivos XML • https://docs.pingidentity.com/bundle/pingfederate-103/page/ruz1628492711606.html https://www.pingidentity.com/en/resources/downloads/pingfederate.html • CWE-611: Improper Restriction of XML External Entity Reference •

CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0

CVE-2021-40329

https://notcve.org/view.php?id=CVE-2021-40329

The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain aspects of external password management. La API de autenticación en Ping Identity PingFederate versiones anteriores a 10.3, maneja inapropiadamente determinados aspectos de la administración de contraseñas externas • https://docs.pingidentity.com/bundle/pingfederate-103/page/cou1615333347158.html •

CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0

CVE-2014-8489 – PingFederate 6.10.1 SP Endpoints Open Redirect

https://notcve.org/view.php?id=CVE-2014-8489

Open redirect vulnerability in startSSO.ping in the SP Endpoints in Ping Identity PingFederate 6.10.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the TargetResource parameter. Vulnerabilidad de redirección abierta en startSSO.ping en SP Endpoints en Ping Identity PingFederate 6.10.1 permite a atacantes remotos redirigir usuarios hacia sitios web arbitrarios y realizar ataques de phishing a través de una URL en el parámetro TargetResource. PingFederate 6.10.1 SP Endpoints suffers from an insecure open redirection vulnerability. • http://packetstormsecurity.com/files/129454/PingFederate-6.10.1-SP-Endpoints-Open-Redirect.html http://seclists.org/fulldisclosure/2014/Dec/35 http://tetraph.com/security/cves/cve-2014-8489-ping-identity-corporation-pingfederate-6-10-1-sp-endpoints-dest-redirect-privilege-escalation-security-vulnerability •