CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2017-7509 – 8: Enrolling certificate without certreq field causes CA to crash
https://notcve.org/view.php?id=CVE-2017-7509
30 Aug 2017 — An input validation error was found in Red Hat Certificate System's handling of client provided certificates before 8.1.20-1. If the certreq field is not present in a certificate an assertion error is triggered causing a denial of service. Se ha detectado un error de validación de entradas en cómo gestiona Red Hat Certificate System los certificados proporcionados por el cliente en versiones anteriores a la 8.1.20-1. Si el campo certreq no está presente en un certificado, se desencadena un error de aserción... • http://www.securitytracker.com/id/1039248 • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 0%CPEs: 7EXPL: 0CVE-2012-4543 – System: Multiple cross-site scripting flaws by displaying CRL or processing profile
https://notcve.org/view.php?id=CVE-2012-4543
04 Jan 2013 — Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Certificate System (RHCS) before 8.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) pageStart or (2) pageSize to the displayCRL script, or (3) nonce variable to the profileProcess script. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en Red Hat Certificate System (RHCS) anteriores a v8.1.3, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de(... • http://rhn.redhat.com/errata/RHSA-2012-1550.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 0CVE-2012-4555 – pki-tps: Temporary denial of service on interrupted token format operations
https://notcve.org/view.php?id=CVE-2012-4555
04 Jan 2013 — The token processing system (pki-tps) in Red Hat Certificate System (RHCS) before 8.1.3 does not properly handle interruptions of token format operations, which allows remote attackers to cause a denial of service (NULL pointer dereference and Apache httpd web server child process crash) via unspecified vectors. El sistema de proceso de tokens (pki-tps) en Red Hat Certificate System (RHCS) anteriores a v8.1.3 no manejan de forma adecuada las interrupciones de las operaciones de formateo, lo que permite a at... • http://rhn.redhat.com/errata/RHSA-2012-1550.html •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2012-4556 – pki-tps: Connection reset when performing empty certificate search in TPS
https://notcve.org/view.php?id=CVE-2012-4556
04 Jan 2013 — The token processing system (pki-tps) in Red Hat Certificate System (RHCS) before 8.1.3 allows remote attackers to cause a denial of service (Apache httpd web server child process restart) via certain unspecified empty search fields in a user certificate search query. El proceso de tokens en sistemas (pki-tps) en Red Hat Certificate System (RHCS) anteriores a v8.1.3 permite a atacantes remotos a provocar una denegación de servicio (reinicio del proceso hijo del servidor httpd del servidor Apache) a través d... • http://rhn.redhat.com/errata/RHSA-2012-1550.html • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 0%CPEs: 7EXPL: 0CVE-2012-2662 – System: multiple XSS flaws
https://notcve.org/view.php?id=CVE-2012-2662
13 Aug 2012 — Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Certificate System (RHCS) before 8.1.1 and Dogtag Certificate System allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to the (1) System Agent or (2) End Entity pages. Múltiples vulnerabilidades de ejecución de comandos en sitios cruzados (XSS) en Red Hat Certificate System (RHCS) antes de v8.1.1 y Dogtag Certificate System permiten a atacantes remotos inyectar secuencias de comandos web o HTML a través de ... • http://osvdb.org/84099 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 1CVE-2012-3367 – System: CA certificate can be revoked
https://notcve.org/view.php?id=CVE-2012-3367
13 Aug 2012 — Red Hat Certificate System (RHCS) before 8.1.1 and Dogtag Certificate System does not properly check certificate revocation requests made through the web interface, which allows remote attackers with permissions to revoke end entity certificates to revoke the Certificate Authority (CA) certificate. Red Hat Certificate System (RHCS) antes de v8.1.1 y Dogtag Certificate System no comprueban correctamente las solicitudes de revocación de certificados realizadas a través de la interfaz web, lo que permite revoc... • http://osvdb.org/84098 • CWE-310: Cryptographic Issues •
CVSS: 8.1EPSS: 0%CPEs: 4EXPL: 0CVE-2008-5082 – System: missing public key challenge proof verification in the TPS component
https://notcve.org/view.php?id=CVE-2008-5082
30 Jan 2009 — The verifyProof function in the Token Processing System (TPS) component in Red Hat Certificate System (RHCS) 7.1 through 7.3 and Dogtag Certificate System 1.0 returns successfully even when token enrollment did not use the hardware key, which allows remote authenticated users with enrollment privileges to bypass intended authentication policies by performing enrollment with a software key. La función verifyProof en el componente Token Processing System (TPS) en Red Hat Certificate System (RHCS) v7.1 hasta v... • http://secunia.com/advisories/33693 • CWE-287: Improper Authentication •
CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 0CVE-2008-1676 – System: incorrect handling of Extensions in CSRs (cs71)
https://notcve.org/view.php?id=CVE-2008-1676
07 Jul 2008 — Red Hat PKI Common Framework (rhpki-common) in Red Hat Certificate System (aka Certificate Server or RHCS) 7.1 through 7.3, and Netscape Certificate Management System 6.x, does not recognize Certificate Authority profile constraints on Extensions, which might allow remote attackers to bypass intended restrictions and conduct man-in-the-middle attacks by submitting a certificate signing request (CSR) and using the resulting certificate. Red Hat PKI Common Framework (rhpki-common) de Red Hat Certificate Syste... • http://rhn.redhat.com/errata/RHSA-2008-0500.html • CWE-255: Credentials Management Errors CWE-297: Improper Validation of Certificate with Host Mismatch •