WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Vendor pingidentity✕
Overview 7 matches · 1 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
7matches 1in Waratek scope14.3% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 1 14.3% Outside Waratek scope 0 0.0% Not applicable 6 85.7% Withdrawn CVE 0 0.0%
Critical 7 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 7 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 7 100.0%
split by peak 2 / quarter
Not applicable: 6No exploit published: 1 Critical: 7 not blocked: 7 No public exploit: 7
Q1 181 No exploit published1 Critical1 not blocked1 No public exploit1 Q2 180 Q3 180 Q4 180 Q1 190 Q2 190 Q3 190 Q4 190 Q1 200 Q2 201 Not applicable1 Critical1 not blocked1 No public exploit1 Q3 200 Q4 200 Q1 210 Q2 210 Q3 211 Not applicable1 Critical1 not blocked1 No public exploit1 Q4 210 Q1 220 Q2 221 Not applicable1 Critical1 not blocked1 No public exploit1 Q3 220 Q4 220 Q1 230 Q2 230 Q3 230 Q4 232 Not applicable2 Critical2 not blocked2 No public exploit2 Q1 241 Not applicable1 Critical1 not blocked1 No public exploit1
Q1 18Q3 18Q1 19Q3 19Q1 20Q3 20Q1 21Q3 21Q1 22Q3 22Q1 23Q3 23Q1 24
7 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-40545 Critical 2024-02-06 Not applicable No public exploit Authentication bypass when an OAuth2 Client is using client_secret_jwt as its authentication method on affected 11.3 versions via specially crafted requests.
CVE-2023-39930 Critical 2023-10-25 Not applicable No public exploit A first-factor authentication bypass vulnerability exists in the PingFederate with PingID Radius PCV when a MSCHAP authentication request is sent via a maliciously crafted RADIUS client request.
CVE-2023-37283 Critical 2023-10-25 Not applicable No public exploit Under a very specific and highly unrecommended configuration, authentication bypass is possible in the PingFederate Identifier First Adapter
CVE-2021-42001 Critical 2022-04-30 Not applicable No public exploit PingID Desktop prior to 1.7.3 has a misconfiguration in the encryption libraries which can lead to sensitive data exposure. An attacker capable of exploiting this vulnerability may be able to successfully complete an MFA challenge via OTP.
CVE-2021-40329 Critical 2021-09-27 Not applicable No public exploit The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain aspects of external password management.
CVE-2020-10654 Critical 2020-05-13 Not applicable No public exploit Ping Identity PingID SSH before 4.0.14 contains a heap buffer overflow in PingID-enrolled servers. This condition can be potentially exploited into a Remote Code Execution vector on the authenticating endpoint.
CVE-2018-1000134 Critical 2018-03-16 No exploit published No public exploit UnboundID LDAP SDK version from commit 801111d8b5c732266a5dbd4b3bb0b6c7b94d7afb up to commit 8471904a02438c03965d21367890276bc25fa5a6, where the issue was reported and fixed contains an Incorrect Access Control vulnerability in process function in SimpleBindRequest class doesn't check for empty password when running in synchronous mode. commit with applied fix https://github.com/pingidentity/ldapsdk/commit/8471904a02438c03965d21367890276bc25fa5a6#diff-f6cb23b459be1ec17df1da33760087fd that can result in Ability to impersonate any valid user. This attack appear to be exploitable via Providing valid username and empty password against servers that do not do additional validation as per https://tools.ietf.org/html/rfc4513#section-5.1.1. This vulnerability appears to have been fixed in after commit 8471904a02438c03965d21367890276bc25fa5a6.