WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product openam✕
Overview 13 matches · 0 in Waratek scope · 0 protected · 1 exploited · 1 CISA KEV · 2 public PoC · 2 EPSS ≥ 0.5
13matches 0in Waratek scope0.0% 0protected0.0% 1exploited7.7% 1CISA KEV7.7% 2public PoC15.4% 2EPSS ≥ 0.515.4%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 13 100.0% Withdrawn CVE 0 0.0%
Critical 2 15.4% High 5 38.5% Medium 4 30.8% Low 2 15.4% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 13 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 7.7% Working exploit published 1 7.7% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 11 84.6%
split by peak 4 / year
Not applicable: 13 Low: 2Medium: 4High: 5Critical: 2 not blocked: 13 No public exploit: 11Working exploit published: 1Exploited: 1
20141 Not applicable1 Low1 not blocked1 No public exploit1 20150 20160 20172 Not applicable2 High2 not blocked2 No public exploit2 20180 20194 Not applicable4 High1 Medium3 not blocked4 No public exploit4 20200 20212 Not applicable2 Critical1 High1 not blocked2 Exploited1 Working exploit published1 20221 Not applicable1 Medium1 not blocked1 No public exploit1 20231 Not applicable1 High1 not blocked1 No public exploit1 20240 20251 Not applicable1 Low1 not blocked1 No public exploit1 20261 Not applicable1 Critical1 not blocked1 No public exploit1
2014201620182020202220242026
13 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-37540 Critical 2026-05-01 Not applicable No public exploit OpenAMP v2025.10.0 ELF loader contains an integer overflow vulnerability in firmware image parsing. In elf_loader.c, it performs multiplication of two attacker-controlled 16-bit values from the ELF header without overflow checking. On 32-bit embedded systems (STM32MP1, Zynq, i.MX), large values can cause the product to wrap around to a small value.
CVE-2025-8662 Low 2025-09-02 Not applicable No public exploit OpenAM (OpenAM Consortium Edition) contains a vulnerability that may cause it to malfunction as a SAML IdP due to a tampered request.This issue affects OpenAM: from 14.0.0 through 14.0.1.
CVE-2023-22320 High 2023-01-10 Not applicable No public exploit OpenAM Web Policy Agent (OpenAM Consortium Edition) provided by OpenAM Consortium parses URLs improperly, leading to a path traversal vulnerability(CWE-22). Furthermore, a crafted URL may be evaluated incorrectly.
CVE-2022-31735 Medium 2022-09-15 Not applicable No public exploit OpenAM Consortium Edition version 14.0.0 provided by OpenAM Consortium contains an open redirect vulnerability (CWE-601). When accessing an affected server through some specially crafted URL, the user may be redirected to an arbitrary website.
CVE-2021-35464 Critical 2021-07-22 Not applicable Exploited ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/* request to the server. The vulnerability exists due to the usage of Sun ONE Application Framework (JATO) found in versions of Java 8 or earlier
CVE-2021-29156 High 2021-03-25 Not applicable Working exploit published ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attacker can perform character-by-character retrieval of password hashes, or retrieve a session token or a private key.
CVE-2017-14395 Medium 2019-06-19 Not applicable No public exploit Auth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctly validate redirect_uri for some invalid requests, which allows attackers to execute a script in the user's browser via reflected XSS.
CVE-2017-14394 Medium 2019-06-19 Not applicable No public exploit OAuth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctly validate redirect_uri for some invalid requests, which allows attackers to perform phishing via an unvalidated redirect.
CVE-2019-5915 Medium 2019-02-13 Not applicable No public exploit Open redirect vulnerability in OpenAM (Open Source Edition) 13.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted page.
CVE-2018-0696 High 2019-02-13 Not applicable No public exploit OpenAM (Open Source Edition) 13.0 and later does not properly manage sessions, which allows remote authenticated attackers to change the security questions and reset the login password via unspecified vectors.
CVE-2017-10873 High 2017-11-02 Not applicable No public exploit OpenAM (Open Source Edition) allows an attacker to bypass authentication and access unauthorized contents via unspecified vectors. Note that this vulnerability affects OpenAM (Open Source Edition) implementations configured as SAML 2.0IdP, and switches authentication methods based on AuthnContext requests sent from the service provider.
CVE-2016-10097 High 2017-01-02 Not applicable No public exploit XML External Entity (XXE) Vulnerability in /SSOPOST/metaAlias/%realm%/idpv2 in OpenAM - Access Management 10.1.0 allows remote attackers to read arbitrary files via the SAMLRequest parameter.
CVE-2014-7246 Low 2014-11-14 Not applicable No public exploit The Core Server in OpenAM 9.5.3 through 9.5.5, 10.0.0 through 10.0.2, 10.1.0-Xpress, and 11.0.0 through 11.0.2, when deployed on a multi-server network, allows remote authenticated users to cause a denial of service (infinite loop) via a crafted cookie in a request.