137 matches found
CVE-2024-49201
The Keyfactor Remote File Orchestrator (also known as remote-file-orchestrator ) version 2.8 before 2.8.1 is vulnerable to an Information Disclosure flaw. The root cause is that sensitive information can be exposed when the system is set to the debug logging level . To remediate this vulnerabilit...
CVE-2024-49202: Incorrect Default Permissions
Keyfactor Command before 12.5.0 has Incorrect Access Control: access tokens are over permissioned, aka 64099. The fixed versions are 11.5.1.1, 11.5.2.1, 11.5.3.1, 11.5.4.5, 11.5.6.1, 11.6.0, 12.2.0.1, 12.3.0.1, 12.4.0.1, 12.5.0, and 24.4.0...
Keyfactor Command security vulnerabilities
Keyfactor Command is a PKI and machine identity automation application from Keyfactor. A security vulnerability exists in Keyfactor Command prior to version 12.5.0 that stems from the inclusion of an incorrect access control issue...
PT-2024-33344 · Keyfactor · Keyfactor Command
Name of the Vulnerable Software and Affected Versions: Keyfactor Command versions prior to 12.5.0 Description: The issue concerns incorrect access control where access tokens have more permissions than allowed. Recommendations: For versions prior to 12.5.0, update to one of the fixed versions:...
CVE-2024-49202
The Keyfactor Command PKI and machine identity automation application is affected by an Incorrect Access Control vulnerability (ID: 64099) in versions prior to 12.5.0 . The root cause is that access tokens are over permissioned , granting more permissions than intended. This flaw could allow unau...
CVE-2024-49201: Insecure Storage of Sensitive Information
Keyfactor Remote File Orchestrator aka remote-file-orchestrator 2.8 before 2.8.1 allows Information Disclosure: sensitive information could be exposed at the debug logging level...
CVE-2024-36066
The CMP CLI client in KeyFactor EJBCA before 8.3.1 has only 6 octets of salt, and is thus not compliant with the security requirements of RFC 4211, and might make man-in-the-middle attacks easier. CMP includes password-based MAC as one of the options for message integrity and authentication the...
CVE-2024-36066
The CMP CLI client in KeyFactor EJBCA before 8.3.1 has only 6 octets of salt, and is thus not compliant with the security requirements of RFC 4211, and might make man-in-the-middle attacks easier. CMP includes password-based MAC as one of the options for message integrity and authentication the...
CVE-2024-36066
The CVE-2024-36066 issue affects KeyFactor EJBCA’s CMP CLI client prior to version 8.3.1. The root cause is a salt length of 6 octets for the password-based MAC parameter, which does not meet RFC 4211 Section 4.4 requirements for a salt of at least 8 octets, potentially reducing resistance to dic...
CVE-2024-36066
The CMP CLI client in KeyFactor EJBCA before 8.3.1 has only 6 octets of salt, and is thus not compliant with the security requirements of RFC 4211, and might make man-in-the-middle attacks easier. CMP includes password-based MAC as one of the options for message integrity and authentication the...
CVE-2024-36066: Undefined Security Weakness
The CMP CLI client in KeyFactor EJBCA before 8.3.1 has only 6 octets of salt, and is thus not compliant with the security requirements of RFC 4211, and might make man-in-the-middle attacks easier. CMP includes password-based MAC as one of the options for message integrity and authentication the...
CVE-2024-42006
Keyfactor AWS Orchestrator through 2.0 allows Information Disclosure...
CVE-2024-42006
Keyfactor AWS Orchestrator through 2.0 allows Information Disclosure...
CVE-2024-34458
Keyfactor Command 10.5.x before 10.5.1 and 11.5.x before 11.5.1 allows SQL Injection which could result in information disclosure...
CVE-2024-33872
Keyfactor Command 10.5.x before 10.5.1 and 11.5.x before 11.5.1 allows SQL Injection which could result in code execution and escalation of privileges...
CVE-2024-34458
Keyfactor Command 10.5.x before 10.5.1 and 11.5.x before 11.5.1 allows SQL Injection which could result in information disclosure...
CVE-2024-42006
Keyfactor AWS Orchestrator through 2.0 allows Information Disclosure...
CVE-2024-33872
Keyfactor Command 10.5.x before 10.5.1 and 11.5.x before 11.5.1 allows SQL Injection which could result in code execution and escalation of privileges...