CVE-2022-23725

PingID Windows Login prior to 2.8 fails to correctly set permissions on Windows Registry entries used to store sensitive API keys. Affected component is the PingID Windows Login application; root cause is improper registry permissions under certain circumstances, potentially exposing API keys loc...

CVE-2022-23720

PingID Windows Login prior to 2.8 is vulnerable when provisioned with the full permissions PingID properties file, allowing administrator-privileged API credentials to be deployed to Windows Login user endpoints. This misprovisioning can enable an attacker to perform administrative actions agains...

CVE-2022-23724

Ping Identity PingID Integration for Windows Login (PingID Windows PingId) is affected by a flaw where static encryption key material enables forging an authentication token to other users within a tenant. This can allow MFA bypass by redirecting an authentication flow to a target user, and explo...

CVE-2020-25826

CVE-2020-25826 affects PingID Integration for Windows Login prior to version 2.4.2. The vulnerability involves local privilege escalation by modifying CefSharp.BrowserSubprocess.exe. Connected documents corroborate the target as PingID integration and CefSharp.BrowserSubprocess.exe, with local ac...

CVE-2022-23717

PingID Windows Login prior to 2.8 is vulnerable to a denial-of-service on local machines when offline security keys are used as part of authentication. The Red Hat and NVD entries corroborate this DoS impact and do not provide a published remediation in the provided documents. No exploit vectors ...

CVE-2021-41992

CVE-2021-41992 relates to a RSA misconfiguration in PingID Windows Login prior to version 2.7, making it susceptible to pre-computed dictionary attacks and enabling an offline MFA bypass. The Red Hat and NVD entries confirm the same description across multiple sources. Affected software is PingID...

CVE-2022-23718

CVE-2022-23718 affects PingID Windows Login prior to version 2.8. The issue arises from use of known vulnerable components, enabling remote code execution. Attack scenarios described include a sophisticated man-in-the-middle position or compromising Ping Identity web servers, permitting an attack...

CVE-2022-23719

PingID Windows Login prior to version 2.8 has an issue where it does not authenticate communication with a local Java service used to capture security key requests. This can allow an attacker who can execute code on the target machine to exploit and spoof the local Java service via multiple attac...

CVE-2022-23721

CVE-2022-23721 affects PingID integration for Windows login prior to version 2.9. The issue arises because the component does not handle duplicate usernames, enabling a username collision when two users with the same username are provisioned on the same machine at different times. Impact is descr...