CVE-2022-23719

MEDIUM Year: 2022
CVSS v3 Score
6.4
Medium
CVSS v2 Score
6.9
Medium
Weakness Type
CWE-288
View all →

Vulnerability Description

PingID Windows Login prior to 2.8 does not authenticate communication with a local Java service used to capture security key requests. An attacker with the ability to execute code on the target machine maybe able to exploit and spoof the local Java service using multiple attack vectors. A successful attack can lead to code executed as SYSTEM by the PingID Windows Login application, or even a denial of service for offline security key authentication.

Related Vulnerabilities

CVE-2020-13185

MEDIUM
CVSS:6.5(Medium)

Certain web application pages in the authenticated section of the Teradici Cloud Access Connector prior to v18 were accessible without the need to specify authentication tokens, which allowed an attac...

CWE-2882020

CVE-2020-1637

MEDIUM
CVSS:6.5(Medium)

A vulnerability in Juniper Networks SRX Series device configured as a Junos OS Enforcer device may allow a user to access network resources that are not permitted by a UAC policy. This issue might occ...

CWE-2882020

CVE-2020-17409

MEDIUM
CVSS:6.5(Medium)

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR R6120, R6080, R6260, R6220, R6020, JNR3210, and WNR2020 routers with firmwar...

CWE-2882020

CVE-2020-27863

MEDIUM
CVSS:6.5(Medium)

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DVA-2800 and DSL-2888A routers. Authentication is not required to exploit thi...

CWE-2882020

CVE-2022-1067

MEDIUM
CVSS:6.5(Medium)

Navigating to a specific URL with a patient ID number will result in the server generating a PDF of a lab report without authentication and rate limiting.

CWE-2882022

CVE-2022-23722

MEDIUM
CVSS:6.5(Medium)

When a password reset mechanism is configured to use the Authentication API with an Authentication Policy, email One-Time Password, PingID or SMS authentication, an existing user can reset another exi...

CWE-2882022