CVE-2021-29156

CVE-2021-29156 概念验证工具 c 2021 GuidePoint Security Charlton Trezevant [email protected] 背景 今天，GuidePoint 很高兴发布一个针对 CVE-2021-29156 的功能性概念验证工具，该漏洞是 ForgeRock OpenAM v13.0.0 中的一个 LDAP 注入漏洞。此漏洞允许攻击者通过逐字符暴力破解攻击，从易受攻击的 OpenAM 服务器中提取多种信息（例如用户的密码哈希）。 使用方法 要使用此工具，只需调整 baseURL、proxy 和 user 变量，然后运行脚本。...

LDAP Injection In OpenAM

OpenAM contains an LDAP injection vulnerability. When a user tries to reset his password, they are asked to enter username, and then the backend validates whether the user exists or not through an LDAP query. If the user exists, the password reset token is sent to the user's email. Enumeration ca...

CVE-2026-33439

🐞 CVE-2026-33439：通过 jato.clientSession 反序列化实现 OpenAM 预认证 RCE 人工洞察 + AI辅助分析 + 逆向工程 + 安全公告 → 利用 首个公开分享的 CVE-2026-33439 利用实现 ForgeRock OpenAM 中的未经认证的 Java 反序列化漏洞，允许通过特制的 JATO 会话对象实现完全远程代码执行。同一条河流流过两次，他们修复了 jato.pageSession（CVE-2021-35464），却忘记了 jato.clientSession（CVE-2026-33439）。反序列化小工具链不问凭证。 📑 目录 概述...

ForgeRock OpenAM <7.0 - Remote Code Execution

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/ request to the server. The vulnerabilit...

CVE-2025-20628 Insufficient granularity of access control for Remote Connector Servers in client mode

An insufficient granularity of access control vulnerability exists in PingIDM formerly ForgeRock Identity Management where administrators cannot properly configure access rules for Remote Connector Servers RCS running in client mode. This means attackers can spoof a client-mode RCS if one exists ...

EUVD-2016-7422

Malware in sbrugna...

EUVD-2018-19007

Malware in sbrugna...

EUVD-2021-23728

Malware in sbrugna...

EUVD-2020-9417

Malware in sbrugna...

EUVD-2017-5897

Malware in sbrugna...

EUVD-2017-5898

Malware in sbrugna...

EUVD-2021-23727

Malware in sbrugna...

EUVD-2023-23885

Malicious code in bioql PyPI...

EUVD-2023-12557

Malicious code in bioql PyPI...

EUVD-2021-34059

Malicious code in bioql PyPI...

EUVD-2023-12400

Malicious code in bioql PyPI...

EUVD-2022-43104

Malicious code in bioql PyPI...

EUVD-2023-12622

Malicious code in bioql PyPI...

CVE-2021-37154

In ForgeRock Access Management AM before 7.0.2, the SAML2 implementation allows XML injection, potentially enabling a fraudulent SAML 2.0 assertion...

CVE-2021-37153

ForgeRock Access Management AM before 7.0.2, when configured with Active Directory as the Identity Store, has an authentication-bypass issue...