CVE-2024-41667

OpenAM is an open access management solution. In versions 15.0.3 and prior, the getCustomLoginUrlTemplate method in RealmOAuth2ProviderSettings.java is vulnerable to template injection due to its usage of user input. Although the developer intended to implement a custom URL for handling login to...

CVE-2016-10097: Improper Restriction of XML External Entity Reference

XML External Entity XXE Vulnerability in /SSOPOST/metaAlias/%realm%/idpv2 in OpenAM - Access Management 10.1.0 allows remote attackers to read arbitrary files via the SAMLRequest parameter...

PT-2017-7730

Name of the Vulnerable Software and Affected Versions OpenAM - Access Management version 10.1.0 Description The issue allows remote attackers to read arbitrary files via the SAMLRequest parameter in the /SSOPOST/metaAlias/%realm%/idpv2 endpoint. This is an XML External Entity XXE vulnerability...