Huawei EulerOS: Security Advisory for pki-core (EulerOS-SA-2021-1698)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CentOS 8 : pki-core:10.6 (CESA-2021:0966)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:0966 advisory. - pki-core: Unprivileged users can renew any certificate CVE-2021-20179 Note that Nessus has not tested for this issue but has instead relied only on the...

EulerOS 2.0 SP5 : pki-core (EulerOS-SA-2021-1698)

According to the version of the pki-core packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from the pki-core server. This...

pki-core: Reflected XSS in getcookies?url= endpoint in CA

A Reflected Cross Site Scripting vulnerability was found in the pki-ca module from the pki-core server. This flaw is caused by missing sanitization of the GET URL parameters. An attacker could abuse this flaw to trick an authenticated user into clicking a specially crafted link which can execute...

pki-core: XSS in the certificate search results

A flaw was found in pki-core. A specially crafted POST request can be used to reflect a DOM-based cross-site scripting XSS attack to inject code into the search query form which can get automatically executed. The highest threat from this vulnerability is to data integrity...

Important: Red Hat Security Advisory: pki-core security update

An update for pki-core is now available for Red Hat Enterprise Linux 7.7 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

pki-core: Unprivileged users can renew any certificate

A flaw was found in pki-core. An attacker who has successfully compromised a key could use this flaw to renew the corresponding certificate over and over again, as long as it is not explicitly revoked. The highest threat from this vulnerability is to data confidentiality and integrity...

Important: Red Hat Security Advisory: pki-core:10.6 security update

An update for the pki-core:10.6 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Moderate: Red Hat Security Advisory: Red Hat Certificate System security and bug fix update

An update for pki-console, pki-core, and redhat-pki-theme is now available for Red Hat Certificate System 9.4 EUS. Red Hat Certificate System 9.4 EUS is a special channel for the delivery of Red Hat Certificate System updates. Downgrading the installed packages is not supported. Red Hat Product...

pki-core: Stored XSS in TPS profile creation

A flaw was found in the pki-core's Token Processing Service TPS where it did not properly sanitize Profile IDs, enabling a Stored Cross-Site Scripting XSS vulnerability when the profile ID is printed. An attacker with sufficient permissions could trick an authenticated victim into executing a...

RLSA-2021:0966 Important: pki-core:10.6 security update

The Public Key Infrastructure PKI Core contains fundamental packages required by Rocky Enterprise Software Foundation Certificate System. Security Fixes: pki-core: Unprivileged users can renew any certificate CVE-2021-20179 For more details about the security issues, including the impact, a CVSS...

pki-core:10.6 security update

An update is available for ldapjdk. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The Public Key Infrastructure PKI Core contains fundamental packages required...

Important: pki-core:10.6 security update

The Public Key Infrastructure PKI Core contains fundamental packages required by AlmaLinux Certificate System. Security Fixes: pki-core: Unprivileged users can renew any certificate CVE-2021-20179 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and...

Cross-Site Scripting (XSS)

pki-core is vulnerable to cross-site scripting. The vulnerability exists due to the pki-core's Token Processing Service TPS not properly sanitizing Profile IDs...

Cross Site Scripting (XSS)

pki-core is cross-site scripting XSS. The vulnerability exists because the Token Processing Service TPS did not properly sanitize several parameters stored for the tokens, possibly resulting in a Stored Cross Site Scripting XSS vulnerability. An attacker able to modify the parameters of any token...

Cross-site Scripting (XSS)

pki-core is vulnerable to cross-site scripting XSS. A remote attacker is able to inject and execute arbitrary Javascript code in a user's browser via the Token IDs from the Activity page...

RHEL 8 : pki-core:10.6 (RHSA-2021:0966)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0966 advisory. The Public Key Infrastructure PKI Core contains fundamental packages required by Red Hat Certificate System. Security Fixes: pki-core: Unprivileged...

RHEL 7 : pki-core (RHSA-2021:0975)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0975 advisory. The Public Key Infrastructure PKI Core contains fundamental packages required by Red Hat Certificate System. Security Fixes: pki-core:...

Moderate: Red Hat Security Advisory: pki-core and redhat-pki-theme security and bug fix update

An update for pki-core and redhat-pki-theme is now available for Red Hat Certificate System 9.7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

pki-core: Stored XSS in TPS profile creation

A flaw was found in the pki-core's Token Processing Service TPS where it did not properly sanitize Profile IDs, enabling a Stored Cross-Site Scripting XSS vulnerability when the profile ID is printed. An attacker with sufficient permissions could trick an authenticated victim into executing a...