Show filters
34 Total Results
Displaying 11-20 of 34
Sort by:
Attacker Value
Unknown

CVE-2022-42069

Disclosure Date: October 14, 2022 (last updated October 08, 2023)
Online Birth Certificate Management System version 1.0 suffers from a persistent Cross Site Scripting (XSS) vulnerability.
Attacker Value
Unknown

CVE-2022-2393

Disclosure Date: July 14, 2022 (last updated October 07, 2023)
A flaw was found in pki-core, which could allow a user to get a certificate for another user identity when directory-based authentication is enabled. This flaw allows an authenticated attacker on the adjacent network to impersonate another user within the scope of the domain, but they would not be able to decrypt message content.
Attacker Value
Unknown

CVE-2022-29005

Disclosure Date: May 23, 2022 (last updated February 23, 2025)
Multiple cross-site scripting (XSS) vulnerabilities in the component /obcs/user/profile.php of Online Birth Certificate System v1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the fname or lname parameters.
Attacker Value
Unknown

CVE-2021-20179

Disclosure Date: March 15, 2021 (last updated February 22, 2025)
A flaw was found in pki-core. An attacker who has successfully compromised a key could use this flaw to renew the corresponding certificate over and over again, as long as it is not explicitly revoked. The highest threat from this vulnerability is to data confidentiality and integrity.
Attacker Value
Unknown

CVE-2019-10180

Disclosure Date: March 31, 2020 (last updated February 21, 2025)
A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service (TPS) did not properly sanitize several parameters stored for the tokens, possibly resulting in a Stored Cross Site Scripting (XSS) vulnerability. An attacker able to modify the parameters of any token could use this flaw to trick an authenticated user into executing arbitrary JavaScript code.
Attacker Value
Unknown

CVE-2020-1696

Disclosure Date: March 20, 2020 (last updated February 21, 2025)
A flaw was found in the all pki-core 10.x.x versions, where Token Processing Service (TPS) where it did not properly sanitize Profile IDs, enabling a Stored Cross-Site Scripting (XSS) vulnerability when the profile ID is printed. An attacker with sufficient permissions could trick an authenticated victim into executing a specially crafted Javascript code.
Attacker Value
Unknown

CVE-2017-7509

Disclosure Date: July 26, 2018 (last updated November 27, 2024)
An input validation error was found in Red Hat Certificate System's handling of client provided certificates before 8.1.20-1. If the certreq field is not present in a certificate an assertion error is triggered causing a denial of service.
0
Attacker Value
Unknown

CVE-2013-1885

Disclosure Date: January 24, 2014 (last updated October 05, 2023)
Multiple cross-site scripting (XSS) vulnerabilities in the token processing system (pki-tps) in Red Hat Certificate System (RHCS) 8.1 and possibly Dogtag Certificate System 9 and 10 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) tus/ or (2) tus/tus/.
0
Attacker Value
Unknown

CVE-2013-1886

Disclosure Date: January 24, 2014 (last updated October 05, 2023)
Format string vulnerability in the token processing system (pki-tps) in Red Hat Certificate System (RHCS) 8.1 and possibly Dogtag Certificate System 9 and 10 allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in unspecified vectors, related to viewing certificates.
0
Attacker Value
Unknown

CVE-2012-4556

Disclosure Date: January 04, 2013 (last updated October 05, 2023)
The token processing system (pki-tps) in Red Hat Certificate System (RHCS) before 8.1.3 allows remote attackers to cause a denial of service (Apache httpd web server child process restart) via certain unspecified empty search fields in a user certificate search query.
0