Priority LOW 21
An error in the SignServer container startup logic was found in Keyfactor SignServer versions prior to 7.2.
CVSS 3.1MEDIUM 4.7· Network · High privileges · No interaction · EPSS 0.00148 · Published 2025-12-22 · No fix listed CWE-642
Priority LOW 29
A class name enumeration was found in Keyfactor SignServer versions prior to 7.3.2.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00318 · Published 2025-11-13 · No fix listed CWE-284
Priority LOW 30
An arbitrary file write was found in Keyfactor SignServer versions prior to 7.3.2.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00266 · Published 2025-11-13 · No fix listed CWE-284
Priority LOW 30
A local file enumeration was found in Keyfactor SignServer versions prior to 7.3.2 .The property VISIBLE_SIGNATURE_CUSTOM_IMAGE_PATH, which exists in the PDFSigner and the PAdESSigner, can be set to any path without any…
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00285 · Published 2025-11-13 · No fix listed CWE-284
Priority LOW 35
A vulnerability was detected in Keyfactor RG-EW5100BE EW_3.0B11P280_EW5100BE-PRO_12183019.
CVSS 4.0MEDIUM 5.1· Network · High privileges · No interaction · EPSS 0.01728 · Published 2025-09-27 · No fix listed CWE-74
Priority LOW 14
The CMP CLI client in KeyFactor EJBCA before 8.3.1 has only 6 octets of salt, and is thus not compliant with the security requirements of RFC 4211, and might make man-in-the-middle attacks easier.
CVSS 3.1LOW 3.1· Network · Low privileges · No interaction · EPSS 0.00168 · Published 2024-09-12 · No fix listed
Priority LOW 33
Keyfactor AWS Orchestrator through 2.0 allows Information Disclosure.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00385 · Published 2024-08-20 · No fix listed CWE-200
Priority LOW 39
Keyfactor Command 10.5.x before 10.5.1 and 11.5.x before 11.5.1 allows SQL Injection which could result in information disclosure.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00379 · Published 2024-08-20 · No fix listed CWE-89
Priority MEDIUM 42
In the Keyfactor EJBCA before 8.0.0, the RA web certificate distribution servlet /ejbca/ra/cert allows partial denial of service due to an authentication issue.
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.00421 · Published 2023-08-03 · No fix listed CWE-287
Priority LOW 25
Keyfactor EJBCA before 7.10.0 allows XSS.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.0038 · Published 2022-11-17 · No fix listed CWE-79
Priority LOW 25
A stored XSS vulnerability was discovered in adminweb/ra/viewendentity.jsp in PrimeKey EJBCA through 7.9.0.2.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00377 · Published 2022-11-17 · No fix listed CWE-79
THREATIST.IORead the docs