Oneidentity vulnerabilities

15 vulnerabilities

Known vulnerabilities in Oneidentity products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 5 products.

Products

Syslog Ng7 vulnerabilities
Password Manager4 vulnerabilities
Cloud Access Manager3 vulnerabilities
Identity Manager1 vulnerabilities
Syslog Ng Store Box1 vulnerabilities

CVE-2020-7962oneidentitypassword_manager5y ago13-11-2020 18:55

EPSS score

0.87%

An issue was discovered in One Identity Password Manager 5.8. An attacker could enumerate valid answers for a user. It is possible for an attacker to detect a valid answer based on the HTTP response content, and reuse this answer later for a password reset on a chosen password. The enumeration is possible because, within the HTTP response content, WRONG ID is only returned when the answer is incorrect.CVE-2020-8019oneidentitysyslog-ng+126y ago29-06-2020 11:30

syslog-ng does not call chdir when it calls chroot, which might allow attackers to escape the intended jail. NOTE: this is only a vulnerability when a separate vulnerability is present. This flaw affects syslog-ng versions prior to and including 2.0.9.CVE-2022-38725alpinesyslog-ng+73y ago23-01-2023 00:00

EPSS score

2.40%

An integer overflow in the RFC3164 parser in One Identity syslog-ng 3.0 through 3.37 allows remote attackers to cause a Denial of Service via crafted syslog input that is mishandled by the tcp or network function. syslog-ng Premium Edition 7.0.30 and syslog-ng Store Box 6.10.0 are also affected.CVE-2011-1951debiansyslog-ng+115y ago11-07-2011 20:00

EPSS score

2.46%

lib/logmatcher.c in Balabit syslog-ng before 3.2.4, when the global flag is set and when using PCRE 8.12 and possibly other versions, allows remote attackers to cause a denial of service (memory consumption) via a message that does not match a regular expression.CVE-2011-0343debiansyslog-ng+115y ago28-01-2011 15:00

EPSS score

0.38%

Balabit syslog-ng 2.0, 3.0, 3.1, 3.2 OSE and PE, when running on FreeBSD or HP-UX, does not properly perform cast operations, which causes syslog-ng to use a default value of -1 to create log files with insecure permissions (07777), which allows local users to read and write to these log files.CVE-2024-47619debiansyslog-ng+51y ago07-05-2025 15:12

EPSS score

0.37%

syslog-ng is an enhanced log daemo. Prior to version 4.8.2, `tls_wildcard_match()` matches on certificates such as `foo.*.bar` although that is not allowed. It is also possible to pass partial wildcards such as `foo.a*c.bar` which glib matches but should be avoided / invalidated. This issue could have an impact on TLS connections, such as in man-in-the-middle situations. Version 4.8.2 contains a fix for the issue.CVE-2024-56404oneidentityidentity manager1y ago24-01-2025 00:00

EPSS score

0.68%

In One Identity Identity Manager 9.x before 9.3, an insecure direct object reference (IDOR) vulnerability allows privilege escalation. Only On-Premise installations are affected.CVE-2002-1200debiansyslog-ng+122y ago01-09-2004 04:00

EPSS score

5.58%

Balabit Syslog-NG 1.4.x before 1.4.15, and 1.5.x before 1.5.20, when using template filenames or output, does not properly track the size of a buffer when constant characters are encountered during macro expansion, which allows remote attackers to cause a denial of service and possibly execute arbitrary code.CVE-2019-13497oneidentitycloud_access_manager6y ago04-11-2019 17:08

EPSS score

0.73%

One Identity Cloud Access Manager before 8.1.4 Hotfix 1 allows CSRF for logout requests.CVE-2019-13498oneidentitycloud_access_manager7y ago29-07-2019 16:01

EPSS score

1.22%

One Identity Cloud Access Manager 8.1.3 does not use HTTP Strict Transport Security (HSTS), which may allow man-in-the-middle (MITM) attacks. This issue is fixed in version 8.1.4.CVE-2019-13496oneidentitycloud_access_manager6y ago04-11-2019 16:56

EPSS score

0.85%

One Identity Cloud Access Manager before 8.1.4 Hotfix 1 allows OTP bypass via vectors involving a man in the middle, the One Identity Defender product, and replacing a failed SAML response with a successful SAML response.CVE-2023-51772oneidentitypassword_manager2y ago25-12-2023 00:00

EPSS score

0.52%

One Identity Password Manager before 5.13.1 allows Kiosk Escape. This product enables users to reset their Active Directory passwords on the login screen of a Windows client. It launches a Chromium based browser in Kiosk mode to provide the reset functionality. The escape sequence is: wait for a session timeout, click on the Help icon, observe that there is a browser window for the One Identity website, navigate to any website that offers file upload, navigate to cmd.exe from the file explorer window, and launch cmd.exe as NT AUTHORITY\SYSTEM.CVE-2023-48654oneidentitypassword_manager2y ago25-12-2023 00:00

EPSS score

1.01%

One Identity Password Manager before 5.13.1 allows Kiosk Escape. This product enables users to reset their Active Directory passwords on the login screen of a Windows client. It launches a Chromium based browser in Kiosk mode to provide the reset functionality. The escape sequence is: go to the Google ReCAPTCHA section, click on the Privacy link, observe that there is a new browser window, navigate to any website that offers file upload, navigate to cmd.exe from the file explorer window, and launch cmd.exe as NT AUTHORITY\SYSTEM.CVE-2023-4003oneone+13y ago27-09-2023 12:11

EPSS score

0.54%

One Identity Password Manager version 5.9.7.1 - An unauthenticated attacker with physical access to a workstation may upgrade privileges to SYSTEM through an unspecified method. CWE-250: Execution with Unnecessary Privileges.