CVE-2021-41770

PingFederate (Ping Identity) before version 10.3.1 is vulnerable to an XXE attack due to improper pre-parsing validation, potentially allowing XML file disclosure. Affected product: PingFederate. Root cause: mishandled pre-parsing validation. Impact: XML data disclosure. Remediation: upgrade to P...

CVE-2021-40329

Summary: CVE-2021-40329 affects Ping Identity PingFederate’s Authentication API prior to version 10.3, where external password management is mishandled. The vulnerability is tied to authentication handling and could impact confidentiality, integrity, and availability as reflected by the CVSS metr...