157 matches found
CVE-2025-21085
PingFederate CVE-2025-21085 describes a grant attribute duplication issue in the PostgreSQL persistence store that can cause excessive memory utilization for OAuth2 requests. The affected product is PingFederate; the root cause is duplication in the OAuth2 grant storage within PostgreSQL, leading...
CVE-2025-21085 PingFederate OAuth Grant attribute duplication may use excessive memory
PingFederate OAuth2 grant duplication in PostgreSQL persistent storage allows OAuth2 requests to use excessive memory utilization...
CVE-2025-21085 PingFederate OAuth Grant attribute duplication may use excessive memory
PingFederate OAuth2 grant duplication in PostgreSQL persistent storage allows OAuth2 requests to use excessive memory utilization...
PT-2025-25500 · Ping Identity · Pingfederate Administrative Console
Name of the Vulnerable Software and Affected Versions: PingFederate Administrative Console affected versions not specified Description: The issue concerns unsanitized user-supplied data saved in the PingFederate Administrative Console, which could trigger the execution of JavaScript code in...
PT-2025-25497 · Ping Identity · Pingfederate
Name of the Vulnerable Software and Affected Versions: PingFederate affected versions not specified Description: The issue concerns PingFederate OAuth2 grant duplication in PostgreSQL persistent storage, allowing OAuth2 requests to use excessive memory utilization. Recommendations: At the moment,...
Ping Identity PingFederate 安全漏洞
Ping Identity PingFederate is a flagship software-based federation server from US-based Ping Identity, Inc. for identity management. Ping Identity PingFederate suffers from a security vulnerability that stems from duplicate OAuth2 authorizations in the PostgreSQL persistence store, which could le...
Ping Identity PingFederate 安全漏洞
Ping Identity PingFederate is a flagship software-based federation server from US-based Ping Identity, Inc. for identity management. A security vulnerability exists in Ping Identity PingFederate that stems from mishandling of non-200 HTTP responses, which could lead to thread exhaustion...
PT-2025-25499 · Ping Identity · Pingfederate Google Adapter
Name of the Vulnerable Software and Affected Versions: PingFederate Google Adapter affected versions not specified Description: The issue is related to the improper handling of non-200 HTTP responses in the PingFederate Google Adapter, which can lead to thread exhaustion under normal usage...
CVE-2023-39219
PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java class loading enumeration requests...
CVE-2023-39930
A first-factor authentication bypass vulnerability exists in the PingFederate with PingID Radius PCV when a MSCHAP authentication request is sent via a maliciously crafted RADIUS client request...
CVE-2023-39231
PingFederate using the PingOne MFA adapter allows a new MFA device to be paired without requiring second factor authentication from an existing registered device. A threat actor may be able to exploit this vulnerability to register their own MFA device if they have knowledge of a victim user's...
CVE-2023-37283
Under a very specific and highly unrecommended configuration, authentication bypass is possible in the PingFederate Identifier First Adapter...
CVE-2022-40724
The PingFederate Local Identity Profiles '/pf/idprofile.ping' endpoint is vulnerable to Cross-Site Request Forgery CSRF through crafted GET requests...
CVE-2022-40723
The PingID RADIUS PCV adapter for PingFederate, which supports RADIUS authentication with PingID MFA, is vulnerable to MFA bypass under certain configurations...
CVE-2022-23723
An MFA bypass vulnerability exists in the PingFederate PingOne MFA Integration Kit when adapter HTML templates are used as part of an authentication flow...
CVE-2022-40722
A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA...
CVE-2024-22377
The deploy directory in PingFederate runtime nodes is reachable to unauthorized users...
CVE-2024-21832
A potential JSON injection attack vector exists in PingFederate REST API data stores using the POST method and a JSON request body...