PT-2020-12758

Name of the Vulnerable Software and Affected Versions CA API Developer Portal versions 4.3.1 and earlier Description The issue allows attackers to perform open redirect attacks due to the insecure handling of homeRedirect page redirects. Recommendations For CA API Developer Portal versions 4.3.1...

CVE-2020-11663: URL Redirection to Untrusted Site

CA API Developer Portal 4.3.1 and earlier handles 404 requests in an insecure manner, which allows attackers to perform open redirect attacks...

CVE-2020-11662: Undefined Security Weakness

CA API Developer Portal 4.3.1 and earlier handles requests insecurely, which allows remote attackers to exploit a Cross-Origin Resource Sharing flaw and access sensitive information...

PT-2020-12757

Name of the Vulnerable Software and Affected Versions CA API Developer Portal versions 4.3.1 and earlier Description The issue allows attackers to perform open redirect attacks due to insecure handling of 404 requests. Recommendations For CA API Developer Portal versions 4.3.1 and earlier, update...

PT-2020-12755

Name of the Vulnerable Software and Affected Versions CA API Developer Portal versions 4.3.1 and earlier Description The issue is related to an access control flaw that allows privileged users to view and edit user data. Recommendations For CA API Developer Portal versions 4.3.1 and earlier, upda...

CVE-2020-11658: Authorization Bypass Through User-Controlled Key

CA API Developer Portal 4.3.1 and earlier handles shared secret keys in an insecure manner, which allows attackers to bypass authorization...

CVE-2020-11666: Undefined Security Weakness

CA API Developer Portal 4.3.1 and earlier contains an access control flaw that allows malicious users to elevate privileges...

CVE-2020-11659: Authorization Bypass Through User-Controlled Key

CA API Developer Portal 4.3.1 and earlier contains an access control flaw that allows privileged users to perform a restricted user administration action...

CVE-2020-11665: URL Redirection to Untrusted Site

CA API Developer Portal 4.3.1 and earlier handles loginRedirect page redirects in an insecure manner, which allows attackers to perform open redirect attacks...

CVE-2020-11664: URL Redirection to Untrusted Site

CA API Developer Portal 4.3.1 and earlier handles homeRedirect page redirects in an insecure manner, which allows attackers to perform open redirect attacks...

Denial Of Service (DoS)

NetworkManager is vulnerable to Denial of Service DoS. A missing network certificate verification flaw was found in NetworkManager. If a user created a WPA Enterprise or 802.1x wireless network connection that was verified using a Certificate Authority CA certificate, and then later removed that ...

CVE-2020-11627

An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. A Cross Site Request Forgery CSRF issue has been found in the CA UI...

CVE-2020-11627

An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. A Cross Site Request Forgery CSRF issue has been found in the CA UI...

CVE-2020-11631

An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. An error state can be generated in the CA UI by a malicious user. This, in turn, allows exploitation of other bugs. This follow-on exploitation can lead to privilege escalation and remote code execution. This is exploitable...

Privilege escalation

An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. An error state can be generated in the CA UI by a malicious user. This, in turn, allows exploitation of other bugs. This follow-on exploitation can lead to privilege escalation and remote code execution. This is exploitable...

Cross site request forgery (csrf)

An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. A Cross Site Request Forgery CSRF issue has been found in the CA UI...

Design/Logic Flaw

An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. The External Command Certificate Validator, which allows administrators to upload external linters to validate certificates, is supposed to save uploaded test certificates to the server. An attacker who has gained access to...

CVE-2020-11631: Undefined Security Weakness

An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. An error state can be generated in the CA UI by a malicious user. This, in turn, allows exploitation of other bugs. This follow-on exploitation can lead to privilege escalation and remote code execution. This is exploitable...

CVE-2020-11627: Cross-Site Request Forgery (CSRF)

An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. A Cross Site Request Forgery CSRF issue has been found in the CA UI...

PT-2020-12737

Name of the Vulnerable Software and Affected Versions EJBCA versions prior to 6.15.2.6 EJBCA versions 7.x prior to 7.3.1.2 Description A Cross Site Request Forgery CSRF issue has been found in the CA UI of EJBCA. This issue allows an attacker to perform actions on behalf of a user without their...