Advisories · Technology
OpenIdentityPlatform OpenAM.
Every CVE that names OpenIdentityPlatform OpenAM among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.3 Medium
OpenAM before 16.1.3 SSRF via OpenID Connect Client jwks_uri
- OpenIdentityPlatform OpenAM
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm Scoping
- OpenIdentityPlatform OpenAM
- Broken access control
- CVSS 6.9 Medium
OpenAM before 16.1.3 Cross-Realm Session Disclosure via Sessions REST Endpoint
- OpenIdentityPlatform OpenAM
- Information disclosure
- CVSS 7.6 High
OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flows
- OpenIdentityPlatform OpenAM
- Broken access control
- CVSS 2.3 Low
OpenAM before 16.1.3 Open Redirect via Unverified id_token_hint in endSession
- OpenIdentityPlatform OpenAM
- Weak cryptography or TLS
- CVSS 5.3 Medium
OpenAM before 16.1.3 Email Content Injection via Users REST Self-Service Actions
- OpenIdentityPlatform OpenAM
- CWE-20
- CVSS 5.1 Medium
OpenAM before 16.1.3 Latent XSS in SAML Load-Balancer Cookie Bounce Page
- OpenIdentityPlatform OpenAM
- Cross-site scripting (XSS)
- CVSS 8.8 High
OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interface
- OpenIdentityPlatform OpenAM
- Authentication bypass
- CVSS 5.3 Medium
OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page
- OpenIdentityPlatform OpenAM
- Cross-site scripting (XSS)