CVSS: 7.8EPSS: 91%CPEs: 7EXPL: 5CVE-2022-2414 – pki-core: access to external entities when parsing XML can lead to XXE
https://notcve.org/view.php?id=CVE-2022-2414
29 Jul 2022 — Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests. El acceso a entidades externas cuando son analizados documentos XML puede conllevar a ataques de tipo XML external entity (XXE). Este fallo permite a un atacante remoto recuperar potencialmente el contenido de archivos arbitrarios mediante el envío de peticiones HTTP especial... • https://github.com/amitlttwo/CVE-2022-2414-Proof-Of-Concept • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2020-25715 – pki-core: XSS in the certificate search results
https://notcve.org/view.php?id=CVE-2020-25715
15 Mar 2021 — A flaw was found in pki-core 10.9.0. A specially crafted POST request can be used to reflect a DOM-based cross-site scripting (XSS) attack to inject code into the search query form which can get automatically executed. The highest threat from this vulnerability is to data integrity. Se encontró un fallo en pki-core versión 10.9.0. Puede ser usado una petición POST especialmente diseñada para reflejar un ataque de tipo cross-site scripting (XSS) basado en DOM para inyectar código en el formulario de con... • https://bugzilla.redhat.com/show_bug.cgi?id=1891016 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.1EPSS: 0%CPEs: 11EXPL: 0CVE-2021-20179 – pki-core: Unprivileged users can renew any certificate
https://notcve.org/view.php?id=CVE-2021-20179
15 Mar 2021 — A flaw was found in pki-core. An attacker who has successfully compromised a key could use this flaw to renew the corresponding certificate over and over again, as long as it is not explicitly revoked. The highest threat from this vulnerability is to data confidentiality and integrity. Se encontró un fallo en pki-core. Un atacante que haya comprometido con éxito una clave podría usar este fallo para renovar el certificado correspondiente una y otra vez, siempre que no se revoque explícitamente. • https://bugzilla.redhat.com/show_bug.cgi?id=1914379 • CWE-863: Incorrect Authorization •