Read the docs

Dogtag PKI

Records16All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high6CVSS 7.0–8.9

Exploited now

Dogtag PKI records in CISA KEV

No Dogtag PKI vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Dogtagpki 14 records HIGH Network Security Services For Java 2 records LOW

Records

16 records

TI-2022-02229 CVE-2022-2414 · GHSA-vjf8-hc3f-mpw4

XML external entity injection in Dogtag PKI

Priority HIGH 74

Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.85393 Published 2022-07-29 Partial fix CWE-611
TI-2021-03479 CVE-2021-20179 · GHSA-q87w-gh3f-77p7

Incorrect authorization in pki-core

Priority LOW 38

A flaw was found in pki-core.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0122 Published 2021-03-15 Partial fix CWE-863
TI-2018-00999 CVE-2018-1080 · GHSA-h277-5r6v-m3gv

Improper access control in [UNKNOWN] pki-core

Priority LOW 38

Dogtag PKI, through version 10.6.1, has a vulnerability in AAclAuthz.java that, under certain configurations, causes the application of ACL allow and deny rules to be reversed.

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.01516 Published 2018-07-02 Partial fix CWE-284
TI-2021-03078 CVE-2021-4213 · GHSA-727r-5fr6-wjfp

Memory leak in JSS

Priority LOW 36

A flaw was found in JSS, where it did not properly free up all memory.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01736 Published 2022-08-24 Fixed CWE-401
TI-2017-05178 CVE-2017-7537 · GHSA-x46g-cxp8-8wjm

Hard-coded credentials in Dogtag PKI pki-core

Priority LOW 36

It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package before 10.6.4.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01458 Published 2018-07-26 Fixed CWE-592
TI-2021-02504 CVE-2021-3551 · GHSA-9ggg-37fj-xc96

Cleartext storage of sensitive information in pki-server

Priority LOW 33

A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00186 Published 2022-02-16 Partial fix CWE-312
TI-2020-15729 CVE-2020-25715 · GHSA-cg99-xqcm-67pf

Cross-site scripting in pki-core

Priority LOW 30

A flaw was found in pki-core 10.9.0.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01142 Published 2021-05-28 Partial fix CWE-79
TI-2019-07541 CVE-2019-10221 · GHSA-wfff-rc4w-hpx2

Cross-site scripting in [UNKNOWN] pki-core

Priority LOW 30

A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from the pki-core server.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01322 Published 2020-03-20 Partial fix CWE-79
TI-2020-01665 CVE-2020-1721 · GHSA-j9fq-77vj-2ww7

Cross-site scripting in pki-core

Priority LOW 29

A flaw was found in the Key Recovery Authority (KRA) Agent Service in pki-core 10.10.5 where it did not properly sanitize the recovery ID during a key recovery request, enabling a reflected cross-site scripting (XSS) vul…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00981 Published 2021-04-30 Fixed CWE-79
TI-2019-07500 CVE-2019-10179 · GHSA-rwmx-694x-q86h

Cross-site scripting in [UNKNOWN] pki-core/pki-kra

Priority LOW 29

A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent Service did not properly sanitize recovery request search page, enabling a Reflected Cross Site Scripting (XSS) vuln…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00938 Published 2020-03-20 Fixed CWE-79
TI-2019-07499 CVE-2019-10178 · GHSA-49c6-93gp-7jrp

Cross-site scripting in pki-core

Priority LOW 29

It was found that the Token Processing Service (TPS) did not properly sanitize the Token IDs from the "Activity" page, enabling a Stored Cross Site Scripting (XSS) vulnerability.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0098 Published 2020-03-18 Partial fix CWE-79
TI-2022-03779 CVE-2022-4132 · GHSA-hcff-4p4q-xjmc

Memory leak on tls connections

Priority LOW 28

A flaw was found in JSS.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00695 Published 2023-10-04 Partial fix · 5.5.0 CWE-401
TI-2020-01643 CVE-2020-1696 · GHSA-59m3-5f56-55x8

Cross-site scripting in [UNKNOWN] pki-core

Priority LOW 26

A flaw was found in the all pki-core 10.x.x versions, where Token Processing Service (TPS) where it did not properly sanitize Profile IDs, enabling a Stored Cross-Site Scripting (XSS) vulnerability when the profile ID is…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00764 Published 2020-03-20 Partial fix CWE-79
TI-2019-07501 CVE-2019-10180 · GHSA-3r6g-5p5v-m39h

Cross-site scripting in [UNKNOWN] pki-core

Priority LOW 23

A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service (TPS) did not properly sanitize several parameters stored for the tokens, possibly resulting in a Stored Cross Site Scripting (…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00734 Published 2020-03-31 Partial fix CWE-79
TI-2019-07469 CVE-2019-10146 · GHSA-9wr3-2hgg-f56c

Cross-site scripting in Red Hat pki-core

Priority LOW 23

A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to the CA Agent Service not properly sanitizing the certificate request page.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00677 Published 2020-03-18 Fixed CWE-79
Open these records in search →