Forgerock Openam — known CVE vulnerabilities

Every CVE whose affected-product data names Forgerock Openam, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (6)

• CVE-2021-35464 — CVSS 9.8 (critical) — actively exploited: ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The…
• CVE-2016-10097 — CVSS 7.5 (high): XML External Entity (XXE) Vulnerability in /SSOPOST/metaAlias/%realm%/idpv2 in OpenAM - Access Management 10.1.0 allows remote attackers to…
• CVE-2021-29156 — CVSS 7.5 (high): ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attacker can perform…
• CVE-2017-14394 — CVSS 6.1 (medium): OAuth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not…
• CVE-2017-14395 — CVSS 6.1 (medium): Auth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not…
• CVE-2014-7246 — CVSS 3.5 (low): The Core Server in OpenAM 9.5.3 through 9.5.5, 10.0.0 through 10.0.2, 10.1.0-Xpress, and 11.0.0 through 11.0.2, when deployed on a…