ForgeRock

Records22All Threatist records

Exploited (KEV)1In CISA KEV

CVSS critical9CVSS 9.0–10.0

CVSS high6CVSS 7.0–8.9

Exploited now

ForgeRock records in CISA KEV

TI-2021-14210 ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability CRITICAL 100KEV 2021-11-03

Components

Products in the NVD configurations · select one to filter the records

Access Management 12 records CRITICAL Openam 6 records CRITICAL Ldap Connector 2 records MEDIUM Identity Manager 1 record LOW Java Policy Agents 1 record MEDIUM Racf Connector 1 record MEDIUM Service Broker 1 record LOW Web Policy Agents 1 record MEDIUM

Records

6 records in Openam · all components

TI-2021-14210 CVE-2021-35464 · GHSA-6x75-vwp5-q242

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the…

CRITICAL 100KEV

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.99999 Published 2021-07-22 No fix listed CWE-502

TI-2021-10026 CVE-2021-29156 · GHSA-8984-9gww-h52x

ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol.

HIGH 72

ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.76846 Published 2021-03-25 No fix listed CWE-74

TI-2016-08176 CVE-2016-10097 · GHSA-3q62-h7x3-478p

XML External Entity (XXE) Vulnerability in /SSOPOST/metaAlias/%realm%/idpv2 in OpenAM…

LOW 38

XML External Entity (XXE) Vulnerability in /SSOPOST/metaAlias/%realm%/idpv2 in OpenAM - Access Management 10.1.0 allows remote attackers to read arbitrary files via the SAMLRequest parameter.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.02524 Published 2017-01-02 No fix listed CWE-611

TI-2017-10502 CVE-2017-14395 · GHSA-vp7f-p539-qwr5

Auth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and…

LOW 29

Auth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctly validate redirect_uri for some invalid requests, which allows attackers to exe…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00793 Published 2019-06-19 No fix listed CWE-79

TI-2017-10501 CVE-2017-14394 · GHSA-5ffc-rjc7-75xf

OAuth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and…

LOW 29

OAuth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctly validate redirect_uri for some invalid requests, which allows attackers to pe…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00794 Published 2019-06-19 No fix listed CWE-601

TI-2014-06031 CVE-2014-7246 · GHSA-xg23-v3j3-p2h3

The Core Server in OpenAM 9.5.3 through 9.5.5, 10.0.0 through 10.0.2, 10.1.0-Xpress, and…

LOW 19

The Core Server in OpenAM 9.5.3 through 9.5.5, 10.0.0 through 10.0.2, 10.1.0-Xpress, and 11.0.0 through 11.0.2, when deployed on a multi-server network, allows remote authenticated users to cause a denial of service (inf…

CVSS 2.0LOW 3.5 Network Low privileges Interaction — EPSS 0.01067 Published 2014-11-14 No fix listed CWE-20

Open these records in search →

Critical	9
High	6
Medium	6
Low	1
No CVSS	0