639 matches found
CVE-2022-34298
The NT auth module in OpenAM before 14.6.6 allows a "replace Samba username attack."...
CVE-2022-34298
OpenAM before 14.6.6 is affected by a vulnerability in the NT auth module that enables a "replace Samba username attack." Multiple sources (Veracode and Red Hat) describe privilege escalation via the userPassword parameter in the process function, enabling an authenticated local attacker to manip...
CVE-2022-34298
The NT auth module in OpenAM before 14.6.6 allows a "replace Samba username attack."...
PT-2022-22114 · Openiam · Openam
Name of the Vulnerable Software and Affected Versions: OpenAM versions prior to 14.6.6 Description: The NT auth module in OpenAM allows a "replace Samba username attack." This issue may potentially be exploited to bypass authentication mechanisms. Recommendations: For versions prior to 14.6.6,...
CVE-2022-34298: Undefined Security Weakness
The NT auth module in OpenAM before 14.6.6 allows a "replace Samba username attack."...
Access Management OpenAM Code Execution
The vulnerability of Access Management AM and OpenAM software solutions is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
Exploit for Injection in Forgerock Openam
CVE-2021-29156 Proof-of-Concept c 2021 GuidePoint Security...
OpenAM 13.0 - LDAP Injection Exploit
Exploit Title: OpenAM 13.0 - LDAP Injection Exploit Author: Charlton Trezevant, GuidePoint Security Vendor Homepage: https://www.forgerock.com/ Software Link: https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/13.0.0,...
OpenAM 13.0 - LDAP Injection
Exploit Title: OpenAM 13.0 - LDAP Injection Date: 03/11/2021 Exploit Author: Charlton Trezevant, GuidePoint Security Vendor Homepage: https://www.forgerock.com/ Software Link: https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/13.0.0,...
ForgeRock OpenAM LDAP Injection
ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol or the password reset feature. For example, an unauthenticated attacker can perform character-by-character retrieval of password hashes, or retrieve a session token or a private key. No source data...
OpenAM RCE (CVE-2021-35464)
Binary data openamcve-2021-35464.nbin...
U.S. Dept Of Defense: [CVE-2021-29156] LDAP Injection at https://██████
Description: https://█████ is vulnerable to CVE-2021-29156 References https://hackerone.com/reports/1278050 https://nvd.nist.gov/vuln/detail/CVE-2021-29156 https://portswigger.net/research/hidden-oauth-attack-vectors...
U.S. Dept Of Defense: [CVE-2021-29156 on ForgeRock OpenAm] LDAP Injection in Webfinger Protocol!
Description: https://████████ is vulnerable to CVE-2021-29156. References https://nvd.nist.gov/vuln/detail/CVE-2021-29156 https://portswigger.net/research/hidden-oauth-attack-vectors...
Last Week’s Security news: Exploits for ForgeRock, vSphere, Apache Tomcat, new Print Spooler vuln, Kaseya Patch and REvil, SolarWinds, Schneider Electric, Bulletins
Hello guys! The fourth episode of Last Week’s Security news, July 12 – July 18. I would like to start with some new public exploits. I think these 4 are the most interesting. If you remember, 2 weeks ago I mentioned the ForgeRock Access Manager and OpenAM vulnerability CVE-2021-35464. Now there i...
Metasploit Wrap-Up
Eternal Blue improvements Prior to this release Metasploit offered two separate exploit modules for targeting MS17-010, dubbed Eternal Blue. The Ruby module previously only supported Windows 7, and a separate ms17010eternalbluewin8 Python module would target Windows 8 and above. Now Metasploit...
ForgeRock Access Manager/OpenAM 14.6.3 Remote Code Execution
Exploit Title: ForgeRock Access Manager/OpenAM 14.6.3 - Remote Code Execution RCE Unauthenticated Date: 2021-07-14 Exploit Author: Photubias – tijldotdeneutatHowestdotbe for www.ic4.be Vendor Advisory: 1 https://backstage.forgerock.com/knowledge/kb/article/a47894244 Vendor Homepage:...
ForgeRock Access Manager / OpenAM 14.6.3 - Remote Code Execution (Unauthenticated) Exploit
Exploit Title: ForgeRock Access Manager/OpenAM 14.6.3 - Remote Code Execution RCE Unauthenticated Date: 2021-07-14 Exploit Author: Photubias – tijldotdeneutatHowestdotbe for www.ic4.be Vendor Advisory: 1 https://backstage.forgerock.com/knowledge/kb/article/a47894244 Vendor Homepage:...
ForgeRock OpenAM Remote Code Execution (CVE-2021-35464)
A remote code execution vulnerability exists in ForgeRock OpenAM. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...
Critical RCE Flaw in ForgeRock Access Manager Under Active Attack
Cybersecurity agencies in Australia and the U.S. are warning of an actively exploited vulnerability impacting ForgeRock's OpenAM access management solution that could be leveraged to execute arbitrary code on an affected system remotely. "The Australian Cyber Security Centre has observed actors...
ForgeRock / OpenAM Jato Java Deserialization
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ForgeRock / OpenAM Jato Java Deserialization', 'Description' = %q This module leverages a pre-authentication remote code execution vulnerability ...