Vulnerabilities > Redhat > Certificate System
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2022-07-14 | CVE-2022-2393 | A flaw was found in pki-core, which could allow a user to get a certificate for another user identity when directory-based authentication is enabled. | 5.7 |
| 2021-03-15 | CVE-2021-20179 | Incorrect Authorization vulnerability in multiple products A flaw was found in pki-core. | 8.1 |
| 2020-03-31 | CVE-2019-10180 | Cross-site Scripting vulnerability in multiple products A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service (TPS) did not properly sanitize several parameters stored for the tokens, possibly resulting in a Stored Cross Site Scripting (XSS) vulnerability. | 4.8 |
| 2020-03-20 | CVE-2020-1696 | Cross-site Scripting vulnerability in multiple products A flaw was found in the all pki-core 10.x.x versions, where Token Processing Service (TPS) where it did not properly sanitize Profile IDs, enabling a Stored Cross-Site Scripting (XSS) vulnerability when the profile ID is printed. | 5.4 |
| 2018-07-26 | CVE-2017-7509 | Improper Input Validation vulnerability in Redhat Certificate System An input validation error was found in Red Hat Certificate System's handling of client provided certificates before 8.1.20-1. | 4.0 |
| 2014-01-24 | CVE-2013-1886 | USE of Externally-Controlled Format String vulnerability in Redhat Certificate System and Dogtag Certificate System Format string vulnerability in the token processing system (pki-tps) in Red Hat Certificate System (RHCS) 8.1 and possibly Dogtag Certificate System 9 and 10 allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in unspecified vectors, related to viewing certificates. | 7.5 |
| 2014-01-24 | CVE-2013-1885 | Cross-Site Scripting vulnerability in Redhat Certificate System and Dogtag Certificate System Multiple cross-site scripting (XSS) vulnerabilities in the token processing system (pki-tps) in Red Hat Certificate System (RHCS) 8.1 and possibly Dogtag Certificate System 9 and 10 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) tus/ or (2) tus/tus/. | 4.3 |
| 2013-01-04 | CVE-2012-4556 | Improper Input Validation vulnerability in Redhat Certificate System The token processing system (pki-tps) in Red Hat Certificate System (RHCS) before 8.1.3 allows remote attackers to cause a denial of service (Apache httpd web server child process restart) via certain unspecified empty search fields in a user certificate search query. | 4.0 |
| 2013-01-04 | CVE-2012-4555 | Cross-Site Scripting and Denial of Service vulnerability in Red Hat Certificate System The token processing system (pki-tps) in Red Hat Certificate System (RHCS) before 8.1.3 does not properly handle interruptions of token format operations, which allows remote attackers to cause a denial of service (NULL pointer dereference and Apache httpd web server child process crash) via unspecified vectors. | 4.0 |
| 2013-01-04 | CVE-2012-4543 | Cross-Site Scripting vulnerability in Redhat Certificate System Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Certificate System (RHCS) before 8.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) pageStart or (2) pageSize to the displayCRL script, or (3) nonce variable to the profileProcess script. | 4.3 |