DO
Product
Dogtagpki
14
CVEs
0
On KEV
8.1
Max CVSS
0
New 30D
Severity mix
Critical 0High 5Medium 9Low 0
Watch
Add Dogtagpki to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-20179 | 8.1 | Mar 15 | A flaw was found in pki-core Affected: before 10.5.0; 10.5.1 before 10.8.0; 10.8.1 before 10.9.0; 10.9.1 before 10.10.0; 10.10.1 before 10.11.0 |
| CVE-2018-1080 | 8.1 | Jul 3 | Dogtag PKI, through version 10.6.1, has a vulnerability in AAclAuthz.java that, under certain configurations, causes the application of ACL allow and deny rules to be reversed Affected: through 10.6.1 |
| CVE-2021-3551 | 7.8 | Feb 16 | A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file Affected: 10.10.0 before 10.10.6 |
| CVE-2022-2414 | 7.5 | Jul 29 | Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks Affected: 10.5.18; 10.7.4; 10.8.3; 10.11.2; 10.12.4; 11.0.5; +1 more |
| CVE-2017-7537 | 7.5 | Jul 26 | It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package before 10.6.4 Affected: before 10.6.4 |
| CVE-2020-15720 | 6.8 | Jul 14 | In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation Affected: through 10.8.3 |
| CVE-2020-25715 | 6.1 | May 28 | A flaw was found in pki-core 10.9.0 Affected: 10.9.0 |
| CVE-2020-1721 | 6.1 | Apr 30 | A flaw was found in the Key Recovery Authority (KRA) Agent Service in pki-core 10.10.5 where it did not properly sanitize the recovery ID during a key recovery request, enabling a… Affected: 10.10.5 |
| CVE-2019-10221 | 6.1 | Mar 20 | A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from the pki-core server Affected: 10.0 through 10.8.3 |
| CVE-2019-10179 | 6.1 | Mar 20 | A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent Service did not properly sanitize recovery request search page, enabling a… Affected: 10.0 through 10.8.3 |
| CVE-2019-10178 | 6.1 | Mar 18 | It was found that the Token Processing Service (TPS) did not properly sanitize the Token IDs from the "Activity" page, enabling a Stored Cross Site Scripting (XSS) vulnerability Affected: All versions, or not specified |
| CVE-2020-1696 | 5.4 | Mar 20 | A flaw was found in the all pki-core 10.x.x versions, where Token Processing Service (TPS) where it did not properly sanitize Profile IDs, enabling a Stored Cross-Site Scripting… Affected: 10.0 through 10.8.3 |
| CVE-2019-10180 | 4.8 | Mar 31 | A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service (TPS) did not properly sanitize several parameters stored for the tokens, possibly… Affected: 10.0 through 10.8.3 |
| CVE-2019-10146 | 4.7 | Mar 18 | A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to the CA Agent Service not properly sanitizing the certificate… Affected: 10.0 through 10.7.3 |
Showing 14