Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

14 records

Vendor: Dogtag PKI Component: Dogtagpki Clear all filters
TI-2022-02229 CVE-2022-2414 · GHSA-vjf8-hc3f-mpw4

XML external entity injection in Dogtag PKI

Priority HIGH 74

Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.85393 Published 2022-07-29 Partial fix CWE-611
TI-2021-02504 CVE-2021-3551 · GHSA-9ggg-37fj-xc96

Cleartext storage of sensitive information in pki-server

Priority LOW 33

A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00186 Published 2022-02-16 Partial fix CWE-312
TI-2020-15729 CVE-2020-25715 · GHSA-cg99-xqcm-67pf

Cross-site scripting in pki-core

Priority LOW 30

A flaw was found in pki-core 10.9.0.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01142 Published 2021-05-28 Partial fix CWE-79
TI-2020-01665 CVE-2020-1721 · GHSA-j9fq-77vj-2ww7

Cross-site scripting in pki-core

Priority LOW 29

A flaw was found in the Key Recovery Authority (KRA) Agent Service in pki-core 10.10.5 where it did not properly sanitize the recovery ID during a key recovery request, enabling a reflected cross-site scripting (XSS) vul…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00981 Published 2021-04-30 Fixed CWE-79
TI-2021-03479 CVE-2021-20179 · GHSA-q87w-gh3f-77p7

Incorrect authorization in pki-core

Priority LOW 38

A flaw was found in pki-core.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0122 Published 2021-03-15 Partial fix CWE-863
TI-2019-07501 CVE-2019-10180 · GHSA-3r6g-5p5v-m39h

Cross-site scripting in [UNKNOWN] pki-core

Priority LOW 23

A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service (TPS) did not properly sanitize several parameters stored for the tokens, possibly resulting in a Stored Cross Site Scripting (…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00734 Published 2020-03-31 Partial fix CWE-79
TI-2020-01643 CVE-2020-1696 · GHSA-59m3-5f56-55x8

Cross-site scripting in [UNKNOWN] pki-core

Priority LOW 26

A flaw was found in the all pki-core 10.x.x versions, where Token Processing Service (TPS) where it did not properly sanitize Profile IDs, enabling a Stored Cross-Site Scripting (XSS) vulnerability when the profile ID is…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00764 Published 2020-03-20 Partial fix CWE-79
TI-2019-07500 CVE-2019-10179 · GHSA-rwmx-694x-q86h

Cross-site scripting in [UNKNOWN] pki-core/pki-kra

Priority LOW 29

A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent Service did not properly sanitize recovery request search page, enabling a Reflected Cross Site Scripting (XSS) vuln…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00938 Published 2020-03-20 Fixed CWE-79
TI-2019-07541 CVE-2019-10221 · GHSA-wfff-rc4w-hpx2

Cross-site scripting in [UNKNOWN] pki-core

Priority LOW 30

A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from the pki-core server.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01322 Published 2020-03-20 Partial fix CWE-79
TI-2019-07499 CVE-2019-10178 · GHSA-49c6-93gp-7jrp

Cross-site scripting in pki-core

Priority LOW 29

It was found that the Token Processing Service (TPS) did not properly sanitize the Token IDs from the "Activity" page, enabling a Stored Cross Site Scripting (XSS) vulnerability.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0098 Published 2020-03-18 Partial fix CWE-79
TI-2019-07469 CVE-2019-10146 · GHSA-9wr3-2hgg-f56c

Cross-site scripting in Red Hat pki-core

Priority LOW 23

A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to the CA Agent Service not properly sanitizing the certificate request page.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00677 Published 2020-03-18 Fixed CWE-79
TI-2017-05178 CVE-2017-7537 · GHSA-x46g-cxp8-8wjm

Hard-coded credentials in Dogtag PKI pki-core

Priority LOW 36

It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package before 10.6.4.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01458 Published 2018-07-26 Fixed CWE-592
TI-2018-00999 CVE-2018-1080 · GHSA-h277-5r6v-m3gv

Improper access control in [UNKNOWN] pki-core

Priority LOW 38

Dogtag PKI, through version 10.6.1, has a vulnerability in AAclAuthz.java that, under certain configurations, causes the application of ACL allow and deny rules to be reversed.

CVSS 3.0HIGH 8.1 Network No auth No interaction EPSS 0.01492 Published 2018-07-02 Partial fix CWE-284