CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2013-1885 – System: pki-tps XSS flaw
https://notcve.org/view.php?id=CVE-2013-1885
Multiple cross-site scripting (XSS) vulnerabilities in the token processing system (pki-tps) in Red Hat Certificate System (RHCS) 8.1 and possibly Dogtag Certificate System 9 and 10 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) tus/ or (2) tus/tus/. Múltiples vulnerabilidades cross-site scripting (XSS) en el sistema de procesamiento de tokens (pki-tps) en Red Hat Certificate System (RHCS) 8.1 y posiblemente Dogtag Certificate System 9 y 10 permite a atacantes remotos inyectar scripts web o HTML arbitrarios a través del PATH_INFO a (1) tus/ o (2) tus/tus/. • http://osvdb.org/93626 http://osvdb.org/93627 http://rhn.redhat.com/errata/RHSA-2013-0856.html http://www.securitytracker.com/id/1029685 https://bugzilla.redhat.com/show_bug.cgi?id=923039 https://exchange.xforce.ibmcloud.com/vulnerabilities/84477 https://access.redhat.com/security/cve/CVE-2013-1885 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 5%CPEs: 3EXPL: 0CVE-2013-1886 – System: pki-tps format string injection
https://notcve.org/view.php?id=CVE-2013-1886
Format string vulnerability in the token processing system (pki-tps) in Red Hat Certificate System (RHCS) 8.1 and possibly Dogtag Certificate System 9 and 10 allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in unspecified vectors, related to viewing certificates. Vulnerabilidad de formato de cadena de texto en el sistema de procesamiento de tokens (pki-tps) en Red Hat Certificate System (RHCS) 8.1 y posiblemente Dogtag Certificate Systsem 9 y 10 permite a usuarios autenticados remotamente causar denegación de servicio (caída) y posiblemente ejecutar código arbitrario a través de especificadores de formato de cadena de texto en vectores no especificados, relacionados con la visualización de certificados. • http://osvdb.org/93613 http://rhn.redhat.com/errata/RHSA-2013-0856.html http://www.securityfocus.com/bid/60085 http://www.securitytracker.com/id/1029685 https://bugzilla.redhat.com/show_bug.cgi?id=924870 https://access.redhat.com/security/cve/CVE-2013-1886 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-134: Use of Externally-Controlled Format String •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 1CVE-2012-3367 – System: CA certificate can be revoked
https://notcve.org/view.php?id=CVE-2012-3367
Red Hat Certificate System (RHCS) before 8.1.1 and Dogtag Certificate System does not properly check certificate revocation requests made through the web interface, which allows remote attackers with permissions to revoke end entity certificates to revoke the Certificate Authority (CA) certificate. Red Hat Certificate System (RHCS) antes de v8.1.1 y Dogtag Certificate System no comprueban correctamente las solicitudes de revocación de certificados realizadas a través de la interfaz web, lo que permite revocar los certificados finales de entidad que revocan certificados de autoridad de certificación (CA) a atacantes remotos con permisos. • http://osvdb.org/84098 http://rhn.redhat.com/errata/RHSA-2012-1103.html http://secunia.com/advisories/50013 http://www.securityfocus.com/bid/54608 http://www.securitytracker.com/id?1027284 https://bugzilla.redhat.com/show_bug.cgi?id=836268 https://exchange.xforce.ibmcloud.com/vulnerabilities/77102 https://fedorahosted.org/pki/changeset/2430 https://access.redhat.com/security/cve/CVE-2012-3367 • CWE-310: Cryptographic Issues •
CVSS: 4.3EPSS: 0%CPEs: 7EXPL: 0CVE-2012-2662 – System: multiple XSS flaws
https://notcve.org/view.php?id=CVE-2012-2662
Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Certificate System (RHCS) before 8.1.1 and Dogtag Certificate System allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to the (1) System Agent or (2) End Entity pages. Múltiples vulnerabilidades de ejecución de comandos en sitios cruzados (XSS) en Red Hat Certificate System (RHCS) antes de v8.1.1 y Dogtag Certificate System permiten a atacantes remotos inyectar secuencias de comandos web o HTML a través de parámetros no especificados a (1) el agente del sistema (System Agent) o (2) las páginas de la entidad final. Multiple cross-site scripting flaws were discovered in the Red Hat Certificate System Agent and End Entity pages. An attacker could use these flaws to perform a cross-site scripting (XSS) attack against victims using the Certificate System's web interface. • http://osvdb.org/84099 http://rhn.redhat.com/errata/RHSA-2012-1103.html http://rhn.redhat.com/errata/RHSA-2015-1347.html http://secunia.com/advisories/50013 http://www.securityfocus.com/bid/54608 http://www.securitytracker.com/id?1027284 https://exchange.xforce.ibmcloud.com/vulnerabilities/77101 https://access.redhat.com/security/cve/CVE-2012-2662 https://bugzilla.redhat.com/show_bug.cgi?id=826646 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.8EPSS: 0%CPEs: 3EXPL: 0CVE-2010-3868 – System: unauthenticated user can request SCEP one-time PIN decryption
https://notcve.org/view.php?id=CVE-2010-3868
Red Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System do not require authentication for requests to decrypt SCEP one-time PINs, which allows remote attackers to obtain PINs by sniffing the network for SCEP requests and then sending decryption requests to the Certificate Authority component. Red Hat Certificate System (RHCS) v7.3 y v8 y Dogtag Certificate System no requieren autenticación en peticiones para descifrar PINs SCEP one-time, lo que permite a atacantes remotos la obtención de PINs rastreando el tráfico de red para peticiones SCEP y a continuación enviando peticiones de descifrado al componente Certificate Authority. • http://secunia.com/advisories/42181 http://securitytracker.com/id?1024697 http://www.osvdb.org/69149 https://bugzilla.redhat.com/show_bug.cgi?id=648882 https://fedorahosted.org/pki/changeset/1261 https://rhn.redhat.com/errata/RHSA-2010-0837.html https://rhn.redhat.com/errata/RHSA-2010-0838.html https://access.redhat.com/security/cve/CVE-2010-3868 • CWE-287: Improper Authentication •