Keyfactor Command security vulnerabilities

Keyfactor Command is a PKI and machine identity automation application from Keyfactor. A security vulnerability exists in Keyfactor Command versions prior to 10.5.1 and prior to 11.5.1, which stems from susceptibility to SQL injection attacks that could lead to code execution and elevation of...

CVE-2024-42006

Keyfactor AWS Orchestrator through 2.0 allows Information Disclosure...

PT-2024-29685 · Keyfactor · Keyfactor Aws Orchestrator

Name of the Vulnerable Software and Affected Versions: Keyfactor AWS Orchestrator versions through 2.0 Description: The issue allows information disclosure. Recommendations: For versions through 2.0, update to a version that contains a fix for this issue. At the moment, there is no information...

CVE-2024-34458

Keyfactor Command 10.5.x before 10.5.1 and 11.5.x before 11.5.1 allows SQL Injection which could result in information disclosure...

Keyfactor AWS Orchestrator security vulnerability

Keyfactor AWS Orchestrator is an application from Keyfactor, Inc. supports certificate inventory and management in AWS Certificate Manager. A security vulnerability exists in Keyfactor AWS Orchestrator 2.0 and prior versions that stems from an information disclosure issue...

CVE-2024-34458: Improper Neutralization of Special Elements used in an SQL Command

Keyfactor Command 10.5.x before 10.5.1 and 11.5.x before 11.5.1 allows SQL Injection which could result in information disclosure...

CVE-2024-34458

Keyfactor Command 10.5.x before 10.5.1 and 11.5.x before 11.5.1 allows SQL Injection which could result in information disclosure...

CVE-2024-33872

Keyfactor Command , a PKI and machine identity automation application, is vulnerable to SQL Injection in versions 10.5.x before 10.5.1 and 11.5.x before 11.5.1. This vulnerability stems from the improper neutralization of special elements used in an SQL command, which could allow an attacker to a...

CVE-2024-42006

CVE-2024-42006 affects Keyfactor AWS Orchestrator up to version 2.0, with an information-disclosure vulnerability reported across multiple feeds. The Red/PRC sources corroborate an information disclosure issue but do not provide concrete exploit vectors or technical root-cause specifics in the su...

CVE-2024-42006: Exposure of Sensitive Information to an Unauthorized Actor

Keyfactor AWS Orchestrator through 2.0 allows Information Disclosure...

CVE-2024-33872: Improper Neutralization of Special Elements used in an SQL Command

Keyfactor Command 10.5.x before 10.5.1 and 11.5.x before 11.5.1 allows SQL Injection which could result in code execution and escalation of privileges...

CVE-2024-34458

Summary: CVE-2024-34458 affects Keyfactor Command. Versions 10.5.x prior to 10.5.1 and 11.5.x prior to 11.5.1 are vulnerable to SQL Injection, which can lead to information disclosure. The exploitation status is not provided in the documents. Impact: information disclosure due to SQL Injection. A...

PT-2024-25912 · Keyfactor · Keyfactor Command

Name of the Vulnerable Software and Affected Versions: Keyfactor Command versions 10.5.x through 10.5.0 Keyfactor Command versions 11.5.x through 11.5.0 Description: The issue allows SQL Injection, which could result in information disclosure. Recommendations: For Keyfactor Command versions 10.5....

BIT-EJBCA-2022-34831

An issue was discovered in Keyfactor PrimeKey EJBCA before 7.9.0, related to possible inconsistencies in DNS identifiers submitted in an ACME order and the corresponding CSR submitted during finalization. During the ACME enrollment process, an order is submitted containing an identifier for one o...

CVE-2023-34196

In the Keyfactor EJBCA before 8.0.0, the RA web certificate distribution servlet /ejbca/ra/cert allows partial denial of service due to an authentication issue. In configurations using OAuth, disclosure of CA certificates attributes and public keys to unauthenticated or less privileged users may...

CVE-2023-34196

In the Keyfactor EJBCA before 8.0.0, the RA web certificate distribution servlet /ejbca/ra/cert allows partial denial of service due to an authentication issue. In configurations using OAuth, disclosure of CA certificates attributes and public keys to unauthenticated or less privileged users may...

Authentication flaw

In the Keyfactor EJBCA before 8.0.0, the RA web certificate distribution servlet /ejbca/ra/cert allows partial denial of service due to an authentication issue. In configurations using OAuth, disclosure of CA certificates attributes and public keys to unauthenticated or less privileged users may...

CVE-2023-34196

Affected software: Keyfactor EJBCA prior to 8.0.0. Vulnerable component: RA web certificate distribution servlet at /ejbca/ra/cert. Root cause: authentication issue enabling partial denial of service. In OAuth configurations, CA certificates (attributes and public keys) may be disclosed to unauth...

CVE-2023-34196: Improper Authentication

In the Keyfactor EJBCA before 8.0.0, the RA web certificate distribution servlet /ejbca/ra/cert allows partial denial of service due to an authentication issue. In configurations using OAuth, disclosure of CA certificates attributes and public keys to unauthenticated or less privileged users may...

CVE-2023-34196

In the Keyfactor EJBCA before 8.0.0, the RA web certificate distribution servlet /ejbca/ra/cert allows partial denial of service due to an authentication issue. In configurations using OAuth, disclosure of CA certificates attributes and public keys to unauthenticated or less privileged users may...