Skip to content
Noroxi

pingidentity records

43 published records for vendor pingidentity.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
2
With a fix record
7%
Median publish → KEV
No record has entered KEV

Records by year

  1. 18
  2. 19
  3. 20
  4. 21
  5. 22
  6. 23
  7. 24

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

Bug bounty scope

The product’s vendor appears in a public program. Matched by name; verify the scope text in the program.

All records

43 records
  • CVE-2018-1000134
    40Plan

    UnboundID LDAP SDK version from commit 801111d8b5c732266a5dbd4b3bb0b6c7b94d7afb up to commit 8471904a02438c03965d21367890276bc25fa5a6, where

    CriticalCVSS 9.8No exploitEPSS 5%

    pingidentity · ldapsdkMar 16, 2018

  • CVE-2020-10654
    40Plan

    Ping Identity PingID SSH before 4.0.14 contains a heap buffer overflow in PingID-enrolled servers.

    CriticalCVSS 9.8No exploitEPSS 3%

    pingidentity · pingid ssh integrationMay 13, 2020

  • CVE-2021-40329
    39Monitor

    The Authentication API in Ping Identity PingFederate before 10.3 mishandles certain aspects of external password management.

    CriticalCVSS 9.8No exploitEPSS 1%

    pingidentity · pingfederateSep 27, 2021

  • CVE-2023-40545
    39Monitor

    PingFederate OAuth client_secret_jwt Authentication Bypass

    CriticalCVSS 9.8No exploitEPSS 1%

    pingidentity · pingfederateFeb 6, 2024

  • CVE-2023-37283
    39Monitor

    Authentication Bypass via HTML Form & Identifier First Adapter

    CriticalCVSS 9.8No exploitEPSS 1%

    pingidentity · pingfederateOct 25, 2023

  • CVE-2023-39930
    39Monitor

    PingFederate PingID Radius PCV Authentication Bypass

    CriticalCVSS 9.8No exploitEPSS 1%

    pingidentity · pingid radius pcvOct 25, 2023

  • CVE-2021-42001
    39Monitor

    PingID Desktop encryption libraries misconfiguration can lead to sensitive data exposure

    CriticalCVSS 9.9No exploitEPSS 1%

    pingidentity · pingid desktopApr 30, 2022

  • CVE-2024-23316
    35Monitor

    PingAccess HTTP Request Desynchronization Weakness

    HighCVSS 8.8No exploitEPSS 1%

    ping identity · pingaccessMay 31, 2024

  • CVE-2023-36496
    35Monitor

    Delegated Admin Virtual Attribute Provider Privilege Escalation

    HighCVSS 8.8No exploitEPSS 1%

    pingidentity · pingdirectoryFeb 1, 2024

  • CVE-2022-40724
    35Monitor

    Cross-Site Request Forgery on PingFederate Local Identity Profiles Endpoint.

    HighCVSS 8.8No exploitEPSS 0%

    pingidentity · pingfederateApr 25, 2023

  • CVE-2022-23718
    33Monitor

    PingID Windows Login prior to 2.8 uses known vulnerable components that can lead to remote code execution

    HighCVSS 8.1No exploitEPSS 2%

    pingidentity · pingid integration for windows loginJun 30, 2022

  • CVE-2022-23724
    32Monitor

    PingID Integration for Windows Login MFA Bypass

    HighCVSS 8.1No exploitEPSS 0%

    pingidentity · pingid integration for windows loginMay 4, 2022

  • CVE-2022-23720
    32Monitor

    PingID Windows Login prior to 2.8 does not alert or halt operation if it has been provisioned with the full permissions PingID properties file

    HighCVSS 8.2No exploitEPSS 0%

    pingidentity · pingid integration for windows loginJun 30, 2022

  • CVE-2020-25826
    31Monitor

    PingID Integration for Windows Login before 2.4.2 allows local users to gain privileges by modifying CefSharp.BrowserSubprocess.exe.

    HighCVSS 7.8No exploitEPSS 0%

    pingidentity · pingid integration for windows loginSep 23, 2020

  • CVE-2021-41770
    30Monitor

    Ping Identity PingFederate before 10.3.1 mishandles pre-parsing validation, leading to an XXE attack that can achieve XML file disclosure.

    HighCVSS 7.5No exploitEPSS 1%

    pingidentity · pingfederateOct 7, 2021

  • CVE-2022-23723
    30Monitor

    PingFederate PingOneMFA Integration Kit MFA Bypass

    HighCVSS 7.7No exploitEPSS 1%

    pingidentity · pingone mfa integration kitMay 2, 2022

  • CVE-2021-41995
    30Monitor

    PingID Mac Login prior to 1.1 vulnerable to pre-computed dictionary attacks

    HighCVSS 7.5No exploitEPSS 1%

    pingidentity · pingid integration for mac loginJun 30, 2022

  • CVE-2023-39219
    30Monitor

    Admin Console Denial of Service via Java class enumeration

    HighCVSS 7.5No exploitEPSS 1%

    pingidentity · pingfederateOct 25, 2023

  • CVE-2021-39270
    30Monitor

    In Ping Identity RSA SecurID Integration Kit before 3.2, user impersonation can occur.

    HighCVSS 7.5No exploitEPSS 0%

    pingidentity · rsa securid integration kitAug 18, 2021

  • CVE-2023-40702
    30Monitor

    PingOne MFA Integration Kit MFA bypass

    HighCVSS 7.7No exploitEPSS 0%

    ping identity · pingone mfa integration kit for pingfederateJul 9, 2024

  • CVE-2014-8489
    26Monitor

    Open redirect vulnerability in startSSO.ping in the SP Endpoints in Ping Identity PingFederate 6.10.1 allows remote attackers to redirect us

    MediumCVSS 6.4No exploitEPSS 3%

    pingidentity · pingfederateDec 12, 2014

  • CVE-2022-23722
    26Monitor

    PingFederate Password Reset via Authentication API Mishandling

    MediumCVSS 6.5No exploitEPSS 1%

    pingidentity · pingfederateMay 2, 2022

  • CVE-2023-39231
    26Monitor

    PingFederate PingOne MFA IK Device Pairing Second Factor Authentication Bypass

    MediumCVSS 6.5No exploitEPSS 1%

    pingidentity · pingone mfa integration kitOct 25, 2023

  • CVE-2021-42000
    26Monitor

    Ping Identity PingFederate Password Reset and Password Change Mishandling with an authentication policy in parallel reset flows

    MediumCVSS 6.5No exploitEPSS 1%

    pingidentity · pingfederateFeb 10, 2022

  • CVE-2022-40723
    26Monitor

    Configuration-based MFA Bypass in PingID RADIUS PCV.

    MediumCVSS 6.5No exploitEPSS 1%

    pingidentity · pingfederateApr 25, 2023