CVSS: 4.0EPSS: 0%CPEs: 3EXPL: 0CVE-2010-3869 – System: SCEP one-time PIN reuse
https://notcve.org/view.php?id=CVE-2010-3869
Red Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System allow remote authenticated users to generate an arbitrary number of certificates by replaying a single SCEP one-time PIN. Red Hat Certificate System (RHCS) v7.3 y v8 y Dogtag Certificate System permiten a usuarios autenticados remotamente generar un número aleatorio de certificados mediante la sustitución de un único PIN SCEP one-time. • http://secunia.com/advisories/42181 http://securitytracker.com/id?1024697 http://www.osvdb.org/69148 https://bugzilla.redhat.com/show_bug.cgi?id=648883 https://fedorahosted.org/pki/changeset/1246 https://rhn.redhat.com/errata/RHSA-2010-0837.html https://rhn.redhat.com/errata/RHSA-2010-0838.html https://access.redhat.com/security/cve/CVE-2010-3869 • CWE-310: Cryptographic Issues •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2009-0588 – rhpki-ra: improper authorization checks in Cerificate System's Registration Authority
https://notcve.org/view.php?id=CVE-2009-0588
agent/request/op.cgi in the Registration Authority (RA) component in Red Hat Certificate System (RHCS) 7.3 and Dogtag Certificate System allows remote authenticated users to approve certificate requests queued for arbitrary agent groups via a modified request ID field. agent/request/op.cgi en el componente Registration Authority (RA) en Red Hat Certificate System (RHCS) 7.3 y Dogtag Certificate System permiten a atacantes remotos autenticados aprobar peticiones de certificado en cola para grupos de agentes de su elección mediante una petición de campo ID modificada. • http://secunia.com/advisories/35242 http://secunia.com/advisories/35263 http://www.redhat.com/support/errata/RHSA-2009-1065.html http://www.securityfocus.com/bid/35104 http://www.securitytracker.com/id?1022278 https://bugzilla.redhat.com/show_bug.cgi?id=484828 https://bugzilla.redhat.com/show_bug.cgi?id=488706 https://access.redhat.com/security/cve/CVE-2009-0588 •
CVSS: 6.0EPSS: 0%CPEs: 4EXPL: 0CVE-2008-5082 – System: missing public key challenge proof verification in the TPS component
https://notcve.org/view.php?id=CVE-2008-5082
The verifyProof function in the Token Processing System (TPS) component in Red Hat Certificate System (RHCS) 7.1 through 7.3 and Dogtag Certificate System 1.0 returns successfully even when token enrollment did not use the hardware key, which allows remote authenticated users with enrollment privileges to bypass intended authentication policies by performing enrollment with a software key. La función verifyProof en el componente Token Processing System (TPS) en Red Hat Certificate System (RHCS) v7.1 hasta v7.3 y Dogtag Certificate System v1.0 devuelve con éxito incluso cuando el token implicado no utiliza la clave hardware, lo cual permite a usuarios remotos autenticados con privilegios implicados evitar políticas de autenticación intencionadas implicándose con una clave software. • http://secunia.com/advisories/33693 http://www.securityfocus.com/bid/33508 http://www.vupen.com/english/advisories/2009/0145 https://bugzilla.redhat.com/show_bug.cgi?id=475998 https://exchange.xforce.ibmcloud.com/vulnerabilities/48331 https://rhn.redhat.com/errata/RHSA-2009-0007.html https://access.redhat.com/security/cve/CVE-2008-5082 • CWE-287: Improper Authentication •