CVE-2026-110805

Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne configuration in the request parameter...

EUVD-2026-102877

Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne configuration in the request parameter...

CVE-2026-110805

A Server-side request forgery (SSRF) vulnerability exists in the PingOne groups endpoint of Devolutions Server versions 2026.3.8.0 and earlier . This flaw allows an authenticated low-privileged user to exfiltrate stored PingOne application secrets by providing an attacker-controlled PingOne confi...

PT-2026-115608

Name of the Vulnerable Software and Affected Versions Devolutions Server versions prior to 2026.3.8.1 Description An authenticated low-privileged user can perform a Server-side request forgery SSRF via the PingOne groups endpoint. This occurs when an attacker-controlled PingOne configuration is...

CVE-2026-110805: Server-Side Request Forgery (SSRF)

Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne configuration in the request parameter...

EUVD-2023-44927

Malicious code in bioql PyPI...

EUVD-2022-28659

Malicious code in bioql PyPI...

CVE-2022-23723

An MFA bypass vulnerability exists in the PingFederate PingOne MFA Integration Kit when adapter HTML templates are used as part of an authentication flow...

GHSA-7726-43HG-M23V OpenAM FreeMarker template injection

OpenAM is an open access management solution. In versions 15.0.3 and prior, the getCustomLoginUrlTemplate method in RealmOAuth2ProviderSettings.java is vulnerable to template injection due to its usage of user input. Although the developer intended to implement a custom URL for handling login to...

CVE-2024-41667

OpenAM

CVE-2023-40702

PingOne MFA Integration Kit contains a vulnerability where the skipMFA action can be configured such that user authentication does not require the second factor authentication from the user's existing registered devices. A threat actor might be able to exploit this vulnerability to authenticate a...

CVE-2023-40356

PingOne MFA Integration Kit contains a vulnerability related to the Prompt Users to Set Up MFA configuration. Under certain conditions, this configuration could allow for a new MFA device to be paired with a target user account without requiring second-factor authentication from the target’s...

CVE-2023-40356 PingOne MFA Integration Kit MFA bypass

PingOne MFA Integration Kit contains a vulnerability related to the Prompt Users to Set Up MFA configuration. Under certain conditions, this configuration could allow for a new MFA device to be paired with a target user account without requiring second-factor authentication from the target’s...

CVE-2023-40356

Affected software: PingOne MFA Integration Kit. Vulnerability: a flaw in the MFA setup prompt could allow pairing a new MFA device with a target user without requiring second‑factor authentication from the user’s existing devices. Root cause / trigger (as stated): may be exploited by a threat act...

CVE-2023-40356 PingOne MFA Integration Kit MFA bypass

PingOne MFA Integration Kit contains a vulnerability related to the Prompt Users to Set Up MFA configuration. Under certain conditions, this configuration could allow for a new MFA device to be paired with a target user account without requiring second-factor authentication from the target’s...

CVE-2023-40702 PingOne MFA Integration Kit MFA bypass

PingOne MFA Integration Kit contains a vulnerability where the skipMFA action can be configured such that user authentication does not require the second factor authentication from the user's existing registered devices. A threat actor might be able to exploit this vulnerability to authenticate a...

CVE-2023-40702

CVE-2023-40702 affects PingOne MFA Integration Kit (Ping Identity). The vulnerability arises from misconfiguration of the skipMFA action, allowing a bypass of second-factor authentication so a threat actor with knowledge of a target user’s first-factor credentials can authenticate as that user. R...

CVE-2023-40702 PingOne MFA Integration Kit MFA bypass

PingOne MFA Integration Kit contains a vulnerability where the skipMFA action can be configured such that user authentication does not require the second factor authentication from the user's existing registered devices. A threat actor might be able to exploit this vulnerability to authenticate a...

PingOne MFA Integration Kit Security Vulnerability

The PingOne MFA Integration Kit is an integration kit from Ping Identity designed to help developers integrate Multi-Factor Authentication MFA functionality into their applications or services. A security vulnerability exists in PingOne MFA Integration Kit versions prior to 2.3.1, which stems fro...

CVE-2023-40702: Authentication Bypass by Spoofing

PingOne MFA Integration Kit contains a vulnerability where the skipMFA action can be configured such that user authentication does not require the second factor authentication from the user's existing registered devices. A threat actor might be able to exploit this vulnerability to authenticate a...