Openam

openam

Vendor: Forgerock • 6 CVEs

CVEs (6)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-35464 1Forgerock 2Access Management Openam Jun 17, 2026 Jul 22, 2021 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by...Show more ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/* request to the server. The vulnerability exists due to the usage of Sun ONE Application Framework (JATO) found in versions of Java 8 or earlierShow less
CVE-2021-29156 1Forgerock 1Openam Jun 17, 2026 Mar 25, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attacker can perform character-by-character retrieval of password hashes, or retrieve a session token or a...Show more ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attacker can perform character-by-character retrieval of password hashes, or retrieve a session token or a private key.Show less
CVE-2017-14395 1Forgerock 2Access Management Openam Nov 21, 2024 Jun 19, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Auth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctly validate redirect_uri for some invalid requests, which allows attackers to exe...Show more Auth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctly validate redirect_uri for some invalid requests, which allows attackers to execute a script in the user's browser via reflected XSS.Show less
CVE-2017-14394 1Forgerock 2Access Management Openam Nov 21, 2024 Jun 19, 2019 N/A· v4 6.1 MEDIUM· v3 5.8 MEDIUM· v2 OAuth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctly validate redirect_uri for some invalid requests, which allows attackers to pe...Show more OAuth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctly validate redirect_uri for some invalid requests, which allows attackers to perform phishing via an unvalidated redirect.Show less
CVE-2016-10097 1Forgerock 1Openam May 6, 2026 Jan 2, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 XML External Entity (XXE) Vulnerability in /SSOPOST/metaAlias/%realm%/idpv2 in OpenAM - Access Management 10.1.0 allows remote attackers to read arbitrary files via the SAMLRequest parameter.
CVE-2014-7246 1Forgerock 1Openam May 6, 2026 Nov 14, 2014 N/A· v4 N/A· v3 3.5 LOW· v2 The Core Server in OpenAM 9.5.3 through 9.5.5, 10.0.0 through 10.0.2, 10.1.0-Xpress, and 11.0.0 through 11.0.2, when deployed on a multi-server network, allows remote authenticated users to cause a denial of service (inf...Show more The Core Server in OpenAM 9.5.3 through 9.5.5, 10.0.0 through 10.0.2, 10.1.0-Xpress, and 11.0.0 through 11.0.2, when deployed on a multi-server network, allows remote authenticated users to cause a denial of service (infinite loop) via a crafted cookie in a request.Show less