Red Hat Certificate System vulnerabilities

18 CVEs affecting Red Hat Certificate System, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-2393, published 2022-07-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2013-1886, published 2014-01-24. High severity, CVSS 7.5. EPSS: 2.2% chance of exploitation in the next 30 days. Format string vulnerability in the token processing system (pki-tps) in Red Hat Certificate System (RHCS) 8.1 and possibly Dogtag Certificate System 9 and 10 allows remote authenticated users to…
CVE-2012-2662, published 2012-08-13. Medium severity, CVSS 4.3. EPSS: 1.4% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Certificate System (RHCS) before 8.1.1 and Dogtag Certificate System allow remote attackers to inject arbitrary web script or HTML via…
CVE-2009-0588, published 2009-05-27. Medium severity, CVSS 6.5. EPSS: 1.3% chance of exploitation in the next 30 days. agent/request/op.cgi in the Registration Authority (RA) component in Red Hat Certificate System (RHCS) 7.3 and Dogtag Certificate System allows remote authenticated users to approve certificate…
CVE-2010-3868, published 2010-11-17. Medium severity, CVSS 5.8. EPSS: 1.3% chance of exploitation in the next 30 days. Red Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System do not require authentication for requests to decrypt SCEP one-time PINs, which allows remote attackers to obtain PINs by…
CVE-2013-1885, published 2014-01-24. Medium severity, CVSS 4.3. EPSS: 1.2% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in the token processing system (pki-tps) in Red Hat Certificate System (RHCS) 8.1 and possibly Dogtag Certificate System 9 and 10 allow remote…
CVE-2012-4543, published 2013-01-04. Medium severity, CVSS 4.3. EPSS: 1.2% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Certificate System (RHCS) before 8.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) pageStart or (2)…
CVE-2021-20179, published 2021-03-15. High severity, CVSS 8.1. EPSS: 1.2% chance of exploitation in the next 30 days. A flaw was found in pki-core. An attacker who has successfully compromised a key could use this flaw to renew the corresponding certificate over and over again, as long as it is not explicitly…
CVE-2012-4556, published 2013-01-04. Medium severity, CVSS 4.0. EPSS: 1.2% chance of exploitation in the next 30 days. The token processing system (pki-tps) in Red Hat Certificate System (RHCS) before 8.1.3 allows remote attackers to cause a denial of service (Apache httpd web server child process restart) via…
CVE-2012-4555, published 2013-01-04. Medium severity, CVSS 4.0. EPSS: 1.2% chance of exploitation in the next 30 days. The token processing system (pki-tps) in Red Hat Certificate System (RHCS) before 8.1.3 does not properly handle interruptions of token format operations, which allows remote attackers to cause a…
CVE-2012-3367, published 2012-08-13. Medium severity, CVSS 5.5. EPSS: 1.2% chance of exploitation in the next 30 days. Red Hat Certificate System (RHCS) before 8.1.1 and Dogtag Certificate System does not properly check certificate revocation requests made through the web interface, which allows remote attackers with…

Latest

CVE-2022-2393, published 2022-07-14. Medium severity, CVSS 5.7. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in pki-core, which could allow a user to get a certificate for another user identity when directory-based authentication is enabled. This flaw allows an authenticated attacker on the…
CVE-2019-10180, published 2020-03-31. Medium severity, CVSS 4.8. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service (TPS) did not properly sanitize several parameters stored for the tokens, possibly resulting in a Stored…
CVE-2020-1696, published 2020-03-20. Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days. A flaw was found in the all pki-core 10.x.x versions, where Token Processing Service (TPS) where it did not properly sanitize Profile IDs, enabling a Stored Cross-Site Scripting (XSS) vulnerability…
CVE-2017-7509, published 2018-07-26. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. An input validation error was found in Red Hat Certificate System's handling of client provided certificates before 8.1.20-1. If the certreq field is not present in a certificate an assertion error…