Authorization

OAuth 2.0 Authorization Server of ForgeRock Access Management OpenAM 13.5.0-13.5.1 and Access Management AM 5.0.0-5.1.1 does not correctly validate redirecturi for some invalid requests, which allows attackers to perform phishing via an unvalidated redirect...

Cross site scripting

Auth 2.0 Authorization Server of ForgeRock Access Management OpenAM 13.5.0-13.5.1 and Access Management AM 5.0.0-5.1.1 does not correctly validate redirecturi for some invalid requests, which allows attackers to execute a script in the user's browser via reflected XSS...

CVE-2017-14395

Auth 2.0 Authorization Server of ForgeRock Access Management OpenAM 13.5.0-13.5.1 and Access Management AM 5.0.0-5.1.1 does not correctly validate redirecturi for some invalid requests, which allows attackers to execute a script in the user's browser via reflected XSS...

CVE-2017-14395

ForgeRock Access Management (OpenAM) 13.5.0–13.5.1 and Access Management (AM) 5.0.0–5.1.1 expose a vulnerability where redirect_uri is not properly validated for some invalid requests, enabling a reflected XSS to execute in the user’s browser. This CVE (CVE-2017-14395) is described in multiple so...

CVE-2017-14394

The CVE-2017-14394 affects ForgeRock OpenAM (OAuth 2.0 Authorization Server) versions 13.5.0–13.5.1 and Access Management (AM) 5.0.0–5.1.1. The issue is improper validation of redirect_uri for certain invalid requests, enabling phishing via an unvalidated redirect. The provided documents do not s...

PT-2019-7969

Name of the Vulnerable Software and Affected Versions ForgeRock Access Management OpenAM versions 13.5.0 through 13.5.1 Access Management AM versions 5.0.0 through 5.1.1 Description The OAuth 2.0 Authorization Server does not correctly validate the redirect uri for some invalid requests, allowing...

CVE-2017-14395: Improper Neutralization of Input During Web Page Generation

Auth 2.0 Authorization Server of ForgeRock Access Management OpenAM 13.5.0-13.5.1 and Access Management AM 5.0.0-5.1.1 does not correctly validate redirecturi for some invalid requests, which allows attackers to execute a script in the user's browser via reflected XSS...

CVE-2019-5915

Open redirect vulnerability in OpenAM Open Source Edition 13.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted page...

CVE-2019-5915

Open redirect vulnerability in OpenAM Open Source Edition 13.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted page...

CVE-2018-0696

OpenAM Open Source Edition 13.0 and later does not properly manage sessions, which allows remote authenticated attackers to change the security questions and reset the login password via unspecified vectors...

Buffer overflow

OpenAM Open Source Edition 13.0 and later does not properly manage sessions, which allows remote authenticated attackers to change the security questions and reset the login password via unspecified vectors...

Open redirect

Open redirect vulnerability in OpenAM Open Source Edition 13.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted page...

CVE-2018-0696

OpenAM Open Source Edition 13.0 and later does not properly manage sessions, which allows remote authenticated attackers to change the security questions and reset the login password via unspecified vectors...

CVE-2018-0696

OpenAM Open Source Edition 13.0 and later does not properly manage sessions, which allows remote authenticated attackers to change the security questions and reset the login password via unspecified vectors...

CVE-2018-0696

OpenAM Open Source Edition 13.0 and later does not properly manage sessions, which allows remote authenticated attackers to change the security questions and reset the login password via unspecified vectors...

CVE-2019-5915

OpenAM (Open Source Edition) 13.0 is affected by CVE-2019-5915, a open redirect vulnerability. A specially crafted page can cause users to be redirected to arbitrary websites, enabling phishing. Root cause is an open redirect in the OpenAM 13.0 flow. Mitigation: apply the patch released by the Op...

CVE-2019-5915

Open redirect vulnerability in OpenAM Open Source Edition 13.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted page...

CVE-2018-0696

OpenAM (Open Source Edition) 13.0 and later is affected by a session management vulnerability that lets an attacker with authentication change security questions and reset the user login password via unspecified vectors. The issue is in OpenAM’s session handling, and affected component is the ses...

CVE-2018-0696: Weak Password Recovery Mechanism for Forgotten Password

OpenAM Open Source Edition 13.0 and later does not properly manage sessions, which allows remote authenticated attackers to change the security questions and reset the login password via unspecified vectors...

PT-2019-8702

Name of the Vulnerable Software and Affected Versions OpenAM Open Source Edition versions prior to 13.0 Description The issue allows remote authenticated attackers to change security questions and reset the login password. Recommendations For versions prior to 13.0, update to version 13.0 or late...