CVE-2022-4132 | Medium | 5.9 | 2023-10-04 | A flaw was found in JSS. A memory leak in JSS requires non-standard configuration but is a low-effort DoS vector if configured that way (repeatedly hitting the… |
CVE-2021-4213 | High | 7.5 | 2022-08-24 | A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted memory builds up in the server memory, saturating the server’s RAM… |
CVE-2022-2414 | High | 7.5 | 2022-07-29 | Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retriev… |
CVE-2021-3551 | High | 7.8 | 2022-02-16 | A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allow… |
CVE-2020-25715 | Medium | 6.1 | 2021-05-28 | A flaw was found in pki-core 10.9.0. A specially crafted POST request can be used to reflect a DOM-based cross-site scripting (XSS) attack to inject code into… |
CVE-2020-1721 | Medium | 6.1 | 2021-04-30 | A flaw was found in the Key Recovery Authority (KRA) Agent Service in pki-core 10.10.5 where it did not properly sanitize the recovery ID during a key recovery… |
CVE-2021-20179 | High | 8.1 | 2021-03-15 | A flaw was found in pki-core. An attacker who has successfully compromised a key could use this flaw to renew the corresponding certificate over and over again… |
CVE-2020-15720 | Medium | 6.8 | 2020-07-14 | In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation. Since the verify parameter was hard-cod… |
CVE-2019-10180 | Low | 2.4 | 2020-03-31 | A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service (TPS) did not properly sanitize several parameters stored for the… |
CVE-2020-1696 | Medium | 4.6 | 2020-03-20 | A flaw was found in the all pki-core 10.x.x versions, where Token Processing Service (TPS) where it did not properly sanitize Profile IDs, enabling a Stored Cr… |
CVE-2019-10221 | Medium | 4.3 | 2020-03-20 | A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from the pki-core server. This flaw is caused… |
CVE-2019-10179 | Medium | 4.3 | 2020-03-20 | A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent Service did not properly sanitize recovery request sear… |
CVE-2019-10178 | Medium | 4.6 | 2020-03-18 | It was found that the Token Processing Service (TPS) did not properly sanitize the Token IDs from the "Activity" page, enabling a Stored Cross Site Scripting (… |
CVE-2019-10146 | Medium | 4.7 | 2020-03-18 | A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to the CA Agent Service not properly saniti… |
CVE-2017-7537 | Medium | 5.9 | 2018-07-26 | It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package before 10.6.4. An attack… |
CVE-2018-1080 | High | 7.5 | 2018-07-03 | Dogtag PKI, through version 10.6.1, has a vulnerability in AAclAuthz.java that, under certain configurations, causes the application of ACL allow and deny rule… |