CVSS: 4.0EPSS: 0%CPEs: 6EXPL: 0CVE-2012-4556 – pki-tps: Connection reset when performing empty certificate search in TPS
https://notcve.org/view.php?id=CVE-2012-4556
The token processing system (pki-tps) in Red Hat Certificate System (RHCS) before 8.1.3 allows remote attackers to cause a denial of service (Apache httpd web server child process restart) via certain unspecified empty search fields in a user certificate search query. El proceso de tokens en sistemas (pki-tps) en Red Hat Certificate System (RHCS) anteriores a v8.1.3 permite a atacantes remotos a provocar una denegación de servicio (reinicio del proceso hijo del servidor httpd del servidor Apache) a través de ciertos campos de búsqueda una petición de búsqueda de certificados. • http://rhn.redhat.com/errata/RHSA-2012-1550.html http://secunia.com/advisories/51482 http://www.securityfocus.com/bid/56843 http://www.securitytracker.com/id?1027846 https://bugzilla.redhat.com/show_bug.cgi?id=869579 https://access.redhat.com/security/cve/CVE-2012-4556 • CWE-20: Improper Input Validation •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 1CVE-2012-3367 – System: CA certificate can be revoked
https://notcve.org/view.php?id=CVE-2012-3367
Red Hat Certificate System (RHCS) before 8.1.1 and Dogtag Certificate System does not properly check certificate revocation requests made through the web interface, which allows remote attackers with permissions to revoke end entity certificates to revoke the Certificate Authority (CA) certificate. Red Hat Certificate System (RHCS) antes de v8.1.1 y Dogtag Certificate System no comprueban correctamente las solicitudes de revocación de certificados realizadas a través de la interfaz web, lo que permite revocar los certificados finales de entidad que revocan certificados de autoridad de certificación (CA) a atacantes remotos con permisos. • http://osvdb.org/84098 http://rhn.redhat.com/errata/RHSA-2012-1103.html http://secunia.com/advisories/50013 http://www.securityfocus.com/bid/54608 http://www.securitytracker.com/id?1027284 https://bugzilla.redhat.com/show_bug.cgi?id=836268 https://exchange.xforce.ibmcloud.com/vulnerabilities/77102 https://fedorahosted.org/pki/changeset/2430 https://access.redhat.com/security/cve/CVE-2012-3367 • CWE-310: Cryptographic Issues •
CVSS: 4.3EPSS: 0%CPEs: 7EXPL: 0CVE-2012-2662 – System: multiple XSS flaws
https://notcve.org/view.php?id=CVE-2012-2662
Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Certificate System (RHCS) before 8.1.1 and Dogtag Certificate System allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to the (1) System Agent or (2) End Entity pages. Múltiples vulnerabilidades de ejecución de comandos en sitios cruzados (XSS) en Red Hat Certificate System (RHCS) antes de v8.1.1 y Dogtag Certificate System permiten a atacantes remotos inyectar secuencias de comandos web o HTML a través de parámetros no especificados a (1) el agente del sistema (System Agent) o (2) las páginas de la entidad final. Multiple cross-site scripting flaws were discovered in the Red Hat Certificate System Agent and End Entity pages. An attacker could use these flaws to perform a cross-site scripting (XSS) attack against victims using the Certificate System's web interface. • http://osvdb.org/84099 http://rhn.redhat.com/errata/RHSA-2012-1103.html http://rhn.redhat.com/errata/RHSA-2015-1347.html http://secunia.com/advisories/50013 http://www.securityfocus.com/bid/54608 http://www.securitytracker.com/id?1027284 https://exchange.xforce.ibmcloud.com/vulnerabilities/77101 https://access.redhat.com/security/cve/CVE-2012-2662 https://bugzilla.redhat.com/show_bug.cgi?id=826646 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •