CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2012-4556 – pki-tps: Connection reset when performing empty certificate search in TPS
https://notcve.org/view.php?id=CVE-2012-4556
04 Jan 2013 — The token processing system (pki-tps) in Red Hat Certificate System (RHCS) before 8.1.3 allows remote attackers to cause a denial of service (Apache httpd web server child process restart) via certain unspecified empty search fields in a user certificate search query. El proceso de tokens en sistemas (pki-tps) en Red Hat Certificate System (RHCS) anteriores a v8.1.3 permite a atacantes remotos a provocar una denegación de servicio (reinicio del proceso hijo del servidor httpd del servidor Apache) a través d... • http://rhn.redhat.com/errata/RHSA-2012-1550.html • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 1CVE-2012-3367 – System: CA certificate can be revoked
https://notcve.org/view.php?id=CVE-2012-3367
13 Aug 2012 — Red Hat Certificate System (RHCS) before 8.1.1 and Dogtag Certificate System does not properly check certificate revocation requests made through the web interface, which allows remote attackers with permissions to revoke end entity certificates to revoke the Certificate Authority (CA) certificate. Red Hat Certificate System (RHCS) antes de v8.1.1 y Dogtag Certificate System no comprueban correctamente las solicitudes de revocación de certificados realizadas a través de la interfaz web, lo que permite revoc... • http://osvdb.org/84098 • CWE-310: Cryptographic Issues •
CVSS: 6.1EPSS: 0%CPEs: 7EXPL: 0CVE-2012-2662 – System: multiple XSS flaws
https://notcve.org/view.php?id=CVE-2012-2662
13 Aug 2012 — Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Certificate System (RHCS) before 8.1.1 and Dogtag Certificate System allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to the (1) System Agent or (2) End Entity pages. Múltiples vulnerabilidades de ejecución de comandos en sitios cruzados (XSS) en Red Hat Certificate System (RHCS) antes de v8.1.1 y Dogtag Certificate System permiten a atacantes remotos inyectar secuencias de comandos web o HTML a través de ... • http://osvdb.org/84099 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2010-3868 – System: unauthenticated user can request SCEP one-time PIN decryption
https://notcve.org/view.php?id=CVE-2010-3868
17 Nov 2010 — Red Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System do not require authentication for requests to decrypt SCEP one-time PINs, which allows remote attackers to obtain PINs by sniffing the network for SCEP requests and then sending decryption requests to the Certificate Authority component. Red Hat Certificate System (RHCS) v7.3 y v8 y Dogtag Certificate System no requieren autenticación en peticiones para descifrar PINs SCEP one-time, lo que permite a atacantes remotos la obtención de P... • http://secunia.com/advisories/42181 • CWE-287: Improper Authentication •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2010-3869 – System: SCEP one-time PIN reuse
https://notcve.org/view.php?id=CVE-2010-3869
17 Nov 2010 — Red Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System allow remote authenticated users to generate an arbitrary number of certificates by replaying a single SCEP one-time PIN. Red Hat Certificate System (RHCS) v7.3 y v8 y Dogtag Certificate System permiten a usuarios autenticados remotamente generar un número aleatorio de certificados mediante la sustitución de un único PIN SCEP one-time. • http://secunia.com/advisories/42181 • CWE-310: Cryptographic Issues •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2009-0588 – rhpki-ra: improper authorization checks in Cerificate System's Registration Authority
https://notcve.org/view.php?id=CVE-2009-0588
27 May 2009 — agent/request/op.cgi in the Registration Authority (RA) component in Red Hat Certificate System (RHCS) 7.3 and Dogtag Certificate System allows remote authenticated users to approve certificate requests queued for arbitrary agent groups via a modified request ID field. agent/request/op.cgi en el componente Registration Authority (RA) en Red Hat Certificate System (RHCS) 7.3 y Dogtag Certificate System permiten a atacantes remotos autenticados aprobar peticiones de certificado en cola para grupos de agentes ... • http://secunia.com/advisories/35242 •
CVSS: 8.1EPSS: 0%CPEs: 4EXPL: 0CVE-2008-5082 – System: missing public key challenge proof verification in the TPS component
https://notcve.org/view.php?id=CVE-2008-5082
30 Jan 2009 — The verifyProof function in the Token Processing System (TPS) component in Red Hat Certificate System (RHCS) 7.1 through 7.3 and Dogtag Certificate System 1.0 returns successfully even when token enrollment did not use the hardware key, which allows remote authenticated users with enrollment privileges to bypass intended authentication policies by performing enrollment with a software key. La función verifyProof en el componente Token Processing System (TPS) en Red Hat Certificate System (RHCS) v7.1 hasta v... • http://secunia.com/advisories/33693 • CWE-287: Improper Authentication •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2008-2367 – System: insecure config file permissions
https://notcve.org/view.php?id=CVE-2008-2367
20 Jan 2009 — Red Hat Certificate System 7.2 uses world-readable permissions for password.conf and unspecified other configuration files, which allows local users to discover passwords by reading these files. Red Hat Certificate System v7.2 utiliza permisos legibles por todo el mundo para password.conf y otros ficheros de configuración sin especificar, lo que permite a usuarios locales descubrir contraseñas leyendo estos ficheros. • http://secunia.com/advisories/33540 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2008-2368 – System: plain text passwords stored in debug log
https://notcve.org/view.php?id=CVE-2008-2368
20 Jan 2009 — Red Hat Certificate System 7.2 stores passwords in cleartext in the UserDirEnrollment log, the RA wizard installer log, and unspecified other debug log files, and uses weak permissions for these files, which allows local users to discover passwords by reading the files. Red Hat Certificate System 7.2 almacena contraseñas en texto claro en el log UserDirEnrollment, el log RA wizard installer, y otros ficheros de log de errores sin especificar, y utiliza la debilidad en los permisos para esos ficheros, lo que... • http://secunia.com/advisories/33540 • CWE-255: Credentials Management Errors •
CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 0CVE-2008-1676 – System: incorrect handling of Extensions in CSRs (cs71)
https://notcve.org/view.php?id=CVE-2008-1676
07 Jul 2008 — Red Hat PKI Common Framework (rhpki-common) in Red Hat Certificate System (aka Certificate Server or RHCS) 7.1 through 7.3, and Netscape Certificate Management System 6.x, does not recognize Certificate Authority profile constraints on Extensions, which might allow remote attackers to bypass intended restrictions and conduct man-in-the-middle attacks by submitting a certificate signing request (CSR) and using the resulting certificate. Red Hat PKI Common Framework (rhpki-common) de Red Hat Certificate Syste... • http://rhn.redhat.com/errata/RHSA-2008-0500.html • CWE-255: Credentials Management Errors CWE-297: Improper Validation of Certificate with Host Mismatch •