CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-7509 – 8: Enrolling certificate without certreq field causes CA to crash
https://notcve.org/view.php?id=CVE-2017-7509
An input validation error was found in Red Hat Certificate System's handling of client provided certificates before 8.1.20-1. If the certreq field is not present in a certificate an assertion error is triggered causing a denial of service. Se ha detectado un error de validación de entradas en cómo gestiona Red Hat Certificate System los certificados proporcionados por el cliente en versiones anteriores a la 8.1.20-1. Si el campo certreq no está presente en un certificado, se desencadena un error de aserción que provoca una denegación de servicio (DoS). An input validation error was found in Red Hat Certificate System's handling of client provided certificates. • http://www.securitytracker.com/id/1039248 https://access.redhat.com/errata/RHSA-2017:2560 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7509 https://access.redhat.com/security/cve/CVE-2017-7509 https://bugzilla.redhat.com/show_bug.cgi?id=1456030 • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2013-1885 – System: pki-tps XSS flaw
https://notcve.org/view.php?id=CVE-2013-1885
Multiple cross-site scripting (XSS) vulnerabilities in the token processing system (pki-tps) in Red Hat Certificate System (RHCS) 8.1 and possibly Dogtag Certificate System 9 and 10 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) tus/ or (2) tus/tus/. Múltiples vulnerabilidades cross-site scripting (XSS) en el sistema de procesamiento de tokens (pki-tps) en Red Hat Certificate System (RHCS) 8.1 y posiblemente Dogtag Certificate System 9 y 10 permite a atacantes remotos inyectar scripts web o HTML arbitrarios a través del PATH_INFO a (1) tus/ o (2) tus/tus/. • http://osvdb.org/93626 http://osvdb.org/93627 http://rhn.redhat.com/errata/RHSA-2013-0856.html http://www.securitytracker.com/id/1029685 https://bugzilla.redhat.com/show_bug.cgi?id=923039 https://exchange.xforce.ibmcloud.com/vulnerabilities/84477 https://access.redhat.com/security/cve/CVE-2013-1885 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 5%CPEs: 3EXPL: 0CVE-2013-1886 – System: pki-tps format string injection
https://notcve.org/view.php?id=CVE-2013-1886
Format string vulnerability in the token processing system (pki-tps) in Red Hat Certificate System (RHCS) 8.1 and possibly Dogtag Certificate System 9 and 10 allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in unspecified vectors, related to viewing certificates. Vulnerabilidad de formato de cadena de texto en el sistema de procesamiento de tokens (pki-tps) en Red Hat Certificate System (RHCS) 8.1 y posiblemente Dogtag Certificate Systsem 9 y 10 permite a usuarios autenticados remotamente causar denegación de servicio (caída) y posiblemente ejecutar código arbitrario a través de especificadores de formato de cadena de texto en vectores no especificados, relacionados con la visualización de certificados. • http://osvdb.org/93613 http://rhn.redhat.com/errata/RHSA-2013-0856.html http://www.securityfocus.com/bid/60085 http://www.securitytracker.com/id/1029685 https://bugzilla.redhat.com/show_bug.cgi?id=924870 https://access.redhat.com/security/cve/CVE-2013-1886 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-134: Use of Externally-Controlled Format String •
CVSS: 4.3EPSS: 0%CPEs: 7EXPL: 0CVE-2012-4543 – System: Multiple cross-site scripting flaws by displaying CRL or processing profile
https://notcve.org/view.php?id=CVE-2012-4543
Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Certificate System (RHCS) before 8.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) pageStart or (2) pageSize to the displayCRL script, or (3) nonce variable to the profileProcess script. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en Red Hat Certificate System (RHCS) anteriores a v8.1.3, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de(1) pageStart o (2) pageSize sobre el script displayCRL, o (3) variable nonce sobre sobre el script profileProcess. • http://rhn.redhat.com/errata/RHSA-2012-1550.html http://rhn.redhat.com/errata/RHSA-2013-0511.html http://secunia.com/advisories/51482 http://www.securityfocus.com/bid/56843 http://www.securitytracker.com/id?1027846 https://bugzilla.redhat.com/show_bug.cgi?id=864397 https://access.redhat.com/security/cve/CVE-2012-4543 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.0EPSS: 0%CPEs: 7EXPL: 0CVE-2012-4555 – pki-tps: Temporary denial of service on interrupted token format operations
https://notcve.org/view.php?id=CVE-2012-4555
The token processing system (pki-tps) in Red Hat Certificate System (RHCS) before 8.1.3 does not properly handle interruptions of token format operations, which allows remote attackers to cause a denial of service (NULL pointer dereference and Apache httpd web server child process crash) via unspecified vectors. El sistema de proceso de tokens (pki-tps) en Red Hat Certificate System (RHCS) anteriores a v8.1.3 no manejan de forma adecuada las interrupciones de las operaciones de formateo, lo que permite a atacantes remotos provocar una denegación de servicio(desreferencia a puntero NULL y caída de proceso hijo del servidor web Apache) a través de vectores no especificados. • http://rhn.redhat.com/errata/RHSA-2012-1550.html http://secunia.com/advisories/51482 http://www.securityfocus.com/bid/56843 http://www.securitytracker.com/id?1027846 https://bugzilla.redhat.com/show_bug.cgi?id=869570 https://access.redhat.com/security/cve/CVE-2012-4555 •