Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2023-4727

Ca: token authentication bypass vulnerability

A flaw was found in dogtag-pki and pki-core. The token authentication scheme can be bypassed with a LDAP injection. By passing the query string parameter sessionID=*, an attacker can authenticate with an existing session saved in the LDAP directory server, which may lead to escalation of privilege.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Certificate System Eus Enterprise Linux Rhel Aus and 4 more
CVE-2026-18369

Dogtag-pki: pki-core: redhat-pki: pki: acme http-01 validation ssrf via ip literal identifiers and unvalidated redirects

A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a public address. An unauthenticated ACME account holder can exploit this to perform server-side request forgery (SSRF), making the Dogtag server send HTTP GET requests to internal network services. With the InMemory database backend, the response body of internal targets is disclosed to the attacker through the ACME challenge error.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Certificate System Certificate System Eus Enterprise Linux and 1 more
CVE-2020-1696

pki-core: Stored XSS in TPS profile creation

A flaw was found in the all pki-core 10.x.x versions, where Token Processing Service (TPS) where it did not properly sanitize Profile IDs, enabling a Stored Cross-Site Scripting (XSS) vulnerability when the profile ID is printed. An attacker with sufficient permissions could trick an authenticated victim into executing a specially crafted Javascript code.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Dogtagpki Redhat
Products
Dogtagpki Certificate System Certificate System Eus
CVE-2019-10180

pki-core: unsanitized token parameters in TPS resulting in stored XSS

A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service (TPS) did not properly sanitize several parameters stored for the tokens, possibly resulting in a Stored Cross Site Scripting (XSS) vulnerability. An attacker able to modify the parameters of any token could use this flaw to trick an authenticated user into executing arbitrary JavaScript code.

CVSS 3.1 · 2.4 Low EPSS < 1% KEV · Not listed
Vendors
Dogtagpki Redhat
Products
Dogtagpki Certificate System Certificate System Eus
CVE-2019-10178

pki-core: stored Cross-site scripting (XSS) in the pki-tps web Activity tab

It was found that the Token Processing Service (TPS) did not properly sanitize the Token IDs from the "Activity" page, enabling a Stored Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker could trick an authenticated victim into creating a specially crafted activity, which would execute arbitrary JavaScript code when viewed in a browser. All versions of pki-core are believed to be vulnerable.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Dogtagpki Redhat
Products
Dogtagpki Certificate System Certificate System Eus