Keyfactor
1 CVEs across 7 Keyfactor products. Browse Keyfactor vulnerabilities, severities, and proof-of-concept exploits.
Keyfactor products with known CVEs
Keyfactor CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2025-26787 | Medium | 4.7 | 2025-12-22 | An error in the SignServer container startup logic was found in Keyfactor SignServer versions prior to 7.2. The Admin CLI command used to configure Certificate… |
CVE-2025-47222 | Medium | 6.5 | 2025-11-13 | A class name enumeration was found in Keyfactor SignServer versions prior to 7.3.2. Setting any chosen class name to any of the properties requiring a class pa… |
CVE-2025-47221 | Medium | 5.3 | 2025-11-13 | An arbitrary file write was found in Keyfactor SignServer versions prior to 7.3.2. The properties ARCHIVETODISK_FILENAME-PATTERN, ARCHIVETODISK_PATH_BASE, ARCH… |
CVE-2025-47220 | Medium | 5.3 | 2025-11-13 | A local file enumeration was found in Keyfactor SignServer versions prior to 7.3.2 .The property VISIBLE_SIGNATURE_CUSTOM_IMAGE_PATH, which exists in the PDFSi… |
CVE-2025-11073 | Medium | 4.7 | 2025-09-27 | A vulnerability was detected in Keyfactor RG-EW5100BE EW_3.0B11P280_EW5100BE-PRO_12183019. The affected element is an unknown function of the file /cgi-bin/luc… |
CVE-2024-36066 | Low | 3.1 | 2024-09-12 | The CMP CLI client in KeyFactor EJBCA before 8.3.1 has only 6 octets of salt, and is thus not compliant with the security requirements of RFC 4211, and might m… |
CVE-2024-42006 | High | 7.5 | 2024-08-20 | Keyfactor AWS Orchestrator through 2.0 allows Information Disclosure. |
CVE-2024-34458 | High | 7.5 | 2024-08-20 | Keyfactor Command 10.5.x before 10.5.1 and 11.5.x before 11.5.1 allows SQL Injection which could result in information disclosure. |
CVE-2023-34196 | High | 8.2 | 2023-08-03 | In the Keyfactor EJBCA before 8.0.0, the RA web certificate distribution servlet /ejbca/ra/cert allows partial denial of service due to an authentication issue… |
CVE-2022-42954 | Medium | 5.4 | 2022-11-17 | Keyfactor EJBCA before 7.10.0 allows XSS. |
CVE-2022-39834 | Medium | 5.4 | 2022-11-17 | A stored XSS vulnerability was discovered in adminweb/ra/viewendentity.jsp in PrimeKey EJBCA through 7.9.0.2. A low-privilege user can store JavaScript in orde… |