CVE-2020-1696

CVE-2020-1696 affects all pki-core 10.x.x versions where the Token Processing Service (TPS) fails to sanitize Profile IDs, enabling Stored XSS when the profile ID is printed. The issue is described as Stored XSS in TPS profile creation/Activity tab across Red Hat advisory references, with an atta...

PT-2020-14898 · Red Hat +1 · Pki-Core +1

Name of the Vulnerable Software and Affected Versions: pki-core versions 10.x.x Description: A flaw was found in the Token Processing Service TPS where it did not properly sanitize Profile IDs, enabling a Stored Cross-Site Scripting XSS vulnerability when the profile ID is printed. An attacker wi...

CVE-2020-1696: Improper Neutralization of Input During Web Page Generation

A flaw was found in the all pki-core 10.x.x versions, where Token Processing Service TPS where it did not properly sanitize Profile IDs, enabling a Stored Cross-Site Scripting XSS vulnerability when the profile ID is printed. An attacker with sufficient permissions could trick an authenticated...

pki-core cross-site scripting vulnerability

pki-core is a library that provides an API for PKI operations. A cross-site scripting vulnerability exists in the Token Processing Service TPS of pki-core. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker could exploit the...

DEBIAN-CVE-2019-10178

It was found that the Token Processing Service TPS did not properly sanitize the Token IDs from the "Activity" page, enabling a Stored Cross Site Scripting XSS vulnerability. An unauthenticated attacker could trick an authenticated victim into creating a specially crafted activity, which would...

CVE-2019-10178

It was found that the Token Processing Service TPS did not properly sanitize the Token IDs from the "Activity" page, enabling a Stored Cross Site Scripting XSS vulnerability. An unauthenticated attacker could trick an authenticated victim into creating a specially crafted activity, which would...

CVE-2019-10178

It was found that the Token Processing Service TPS did not properly sanitize the Token IDs from the "Activity" page, enabling a Stored Cross Site Scripting XSS vulnerability. An unauthenticated attacker could trick an authenticated victim into creating a specially crafted activity, which would...

Cross site scripting

It was found that the Token Processing Service TPS did not properly sanitize the Token IDs from the "Activity" page, enabling a Stored Cross Site Scripting XSS vulnerability. An unauthenticated attacker could trick an authenticated victim into creating a specially crafted activity, which would...

CVE-2019-10178

It was found that the Token Processing Service TPS did not properly sanitize the Token IDs from the "Activity" page, enabling a Stored Cross Site Scripting XSS vulnerability. An unauthenticated attacker could trick an authenticated victim into creating a specially crafted activity, which would...

UBUNTU-CVE-2019-10178

It was found that the Token Processing Service TPS did not properly sanitize the Token IDs from the "Activity" page, enabling a Stored Cross Site Scripting XSS vulnerability. An unauthenticated attacker could trick an authenticated victim into creating a specially crafted activity, which would...

CVE-2019-10178

Removed by vendor...

CVE-2019-10178

CVE-2019-10178 is a stored XSS vulnerability in the Token Processing Service (TPS) of the open-source PKI core. The root cause is unsanitized Token IDs from the Activity page, allowing an unauthenticated attacker to persuade an authenticated user to create a crafted activity, which will execute a...

CVE-2019-10178

It was found that the Token Processing Service TPS did not properly sanitize the Token IDs from the "Activity" page, enabling a Stored Cross Site Scripting XSS vulnerability. An unauthenticated attacker could trick an authenticated victim into creating a specially crafted activity, which would...

CVE-2019-10178: Improper Neutralization of Input During Web Page Generation

It was found that the Token Processing Service TPS did not properly sanitize the Token IDs from the "Activity" page, enabling a Stored Cross Site Scripting XSS vulnerability. An unauthenticated attacker could trick an authenticated victim into creating a specially crafted activity, which would...

PT-2020-9055 · Pki-Core +1 · Pki-Core +1

Name of the Vulnerable Software and Affected Versions: pki-core affected versions not specified Description: The Token Processing Service TPS did not properly sanitize the Token IDs from the "Activity" page, enabling a Stored Cross Site Scripting XSS vulnerability. An unauthenticated attacker cou...

CVE-2019-10178

It was found that the Token Processing Service TPS did not properly sanitize the Token IDs from the "Activity" page, enabling a Stored Cross Site Scripting XSS vulnerability. An unauthenticated attacker could trick an authenticated victim into creating a specially crafted activity, which would...

CVE-2019-10180

It was found that the Token Processing Service TPS did not properly sanitize several parameters stored for the tokens, possibly resulting in a Stored Cross Site Scripting XSS vulnerability. An attacker able to modify the parameters of any token could use this flaw to trick an authenticated user...

CVE-2020-1696

A flaw was found in the pki-core's Token Processing Service TPS where it did not properly sanitize Profile IDs, enabling a Stored Cross-Site Scripting XSS vulnerability when the profile ID is printed. An attacker with sufficient permissions could trick an authenticated victim into executing a...

Arbitrary Code Execution

Red Hat Certificate System RHCS is an enterprise software system designed to manage enterprise Public Key Infrastructure PKI deployments. The Token Processing System TPS is a PKI subsystem that acts as a Registration Authority RA for authenticating and processing enrollment requests, PIN reset...

Moderate: Red Hat Security Advisory: Red Hat Certificate System 8 security, bug fix, and enhancement update

An update is now available for Red Hat Certificate System 8 with Advanced Access. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...