WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Vendor pingidentity✕
Overview 14 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
14matches 0in Waratek scope0.0% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 14 100.0% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 14 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 14 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 14 100.0%
split by peak 6 / year
Not applicable: 14 Medium: 14 not blocked: 14 No public exploit: 14
20141 Not applicable1 Medium1 not blocked1 No public exploit1 20150 20160 20170 20180 20191 Not applicable1 Medium1 not blocked1 No public exploit1 20200 20211 Not applicable1 Medium1 not blocked1 No public exploit1 20226 Not applicable6 Medium6 not blocked6 No public exploit6 20233 Not applicable3 Medium3 not blocked3 No public exploit3 20242 Not applicable2 Medium2 not blocked2 No public exploit2
20142015201620172018201920202021202220232024
14 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2024-22477 Medium 2024-07-09 Not applicable No public exploit A cross-site scripting vulnerability exists in the admin console OIDC Policy Management Editor. The impact is contained to admin console users only.
CVE-2024-22377 Medium 2024-07-09 Not applicable No public exploit The deploy directory in PingFederate runtime nodes is reachable to unauthorized users.
CVE-2023-34085 Medium 2023-10-25 Not applicable No public exploit When an AWS DynamoDB table is used for user attribute storage, it is possible to retrieve the attributes of another user using a maliciously crafted request
CVE-2022-40723 Medium 2023-04-25 Not applicable No public exploit The PingID RADIUS PCV adapter for PingFederate, which supports RADIUS authentication with PingID MFA, is vulnerable to MFA bypass under certain configurations.
CVE-2018-25084 Medium 2023-04-10 Not applicable No public exploit A vulnerability, which was classified as problematic, has been found in Ping Identity Self-Service Account Manager 1.1.2. Affected by this issue is some unknown functionality of the file src/main/java/com/unboundid/webapp/ssam/SSAMController.java. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.1.3 is able to address this issue. The patch is identified as f64b10d63bb19ca2228b0c2d561a1a6e5a3bf251. It is recommended to upgrade the affected component. VDB-225362 is the identifier assigned to this vulnerability.
CVE-2022-23726 Medium 2022-09-30 Not applicable No public exploit PingCentral versions prior to listed versions expose Spring Boot actuator endpoints that with administrative authentication return large amounts of sensitive environmental and application information.
CVE-2022-23717 Medium 2022-06-30 Not applicable No public exploit PingID Windows Login prior to 2.8 is vulnerable to a denial of service condition on local machines when combined with using offline security keys as part of authentication.
CVE-2022-23722 Medium 2022-05-02 Not applicable No public exploit When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID or SMS authentication, an existing user can reset another existing user’s password.
CVE-2021-41994 Medium 2022-04-30 Not applicable No public exploit A misconfiguration of RSA in PingID iOS app prior to 1.19 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass when using PingID Windows Login.
CVE-2021-41993 Medium 2022-04-30 Not applicable No public exploit A misconfiguration of RSA in PingID Android app prior to 1.19 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass when using PingID Windows Login.
CVE-2021-42000 Medium 2022-02-10 Not applicable No public exploit When a password reset or password change flow with an authentication policy is configured and the adapter in the reset or change policy supports multiple parallel reset flows, an existing user can reset another existing users password.
CVE-2021-31923 Medium 2021-09-24 Not applicable No public exploit Ping Identity PingAccess before 5.3.3 allows HTTP request smuggling via header manipulation.
CVE-2019-13564 Medium 2019-07-11 Not applicable No public exploit XSS exists in Ping Identity Agentless Integration Kit before 1.5.
CVE-2014-8489 Medium 2014-12-12 Not applicable No public exploit Open redirect vulnerability in startSSO.ping in the SP Endpoints in Ping Identity PingFederate 6.10.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the TargetResource parameter.