openam vulnerabilities (Ubuntu)
20 vulnerabilities.
-
openamUbuntu OpenAM Insecure SSO Cookie Initialization 7.4 High -
openamUbuntu OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback 9.8 Critical -
openamUbuntu OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page 6.1 Medium -
openamUbuntu OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass 9.2 Critical -
openamUbuntu OpenAM OAuth Authorization Bypass via PKCE Challenge 9.1 Critical -
openamUbuntu OpenAM OAuth Client Impersonation via JWKS Resolver Cache 7.6 High -
openamUbuntu OpenAM Authenticated RCE via Groovy Sandbox Escape 7.5 High -
openamUbuntu OpenAM Account Takeover via Unverified Password Change in OAuth2 Module 7.4 High -
openamUbuntu OpenAM Authentication Bypass via MSISDN LDAP Injection 9.3 Critical -
openamUbuntu OpenAM Arbitrary OAuth Token Minting via Push Registration 7.6 High -
openamUbuntu OpenAM Unsafe Java Deserialization via SNS 7.7 High -
openamUbuntu OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints 9.3 Critical -
openamUbuntu OpenAM Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage 9.2 Critical -
openamUbuntu OpenAM Session Hijacking via CDSSO 8.3 High -
openamUbuntu OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC 8.5 High -
openamUbuntu OpenAM: Pre-authentication Reflected XSS in SAML2 Cluster Cookie-Hash-Redirect Path via `FSUtils.postToTarget` 7.0 High -
openamUbuntu OpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl) 8.3 High -
openamUbuntu OpenAM Authenticated Server-Side Request Forgery (SSRF) via `/sessionservice` 5.3 Medium -
openamUbuntu OpenAM LDAP Injection via `_queryId` Parameter 7.1 High -
openamUbuntu OpenAM (Open Source Edition) allows an attacker to bypass authentication and access unauthorized... 8.1 High