Cross site request forgery (csrf)

An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. A Cross Site Request Forgery CSRF issue has been found in the CA UI...

Design/Logic Flaw

An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. The External Command Certificate Validator, which allows administrators to upload external linters to validate certificates, is supposed to save uploaded test certificates to the server. An attacker who has gained access to...

CVE-2020-11631: Undefined Security Weakness

An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. An error state can be generated in the CA UI by a malicious user. This, in turn, allows exploitation of other bugs. This follow-on exploitation can lead to privilege escalation and remote code execution. This is exploitable...

CVE-2020-11627: Cross-Site Request Forgery (CSRF)

An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. A Cross Site Request Forgery CSRF issue has been found in the CA UI...

PT-2020-12737

Name of the Vulnerable Software and Affected Versions EJBCA versions prior to 6.15.2.6 EJBCA versions 7.x prior to 7.3.1.2 Description A Cross Site Request Forgery CSRF issue has been found in the CA UI of EJBCA. This issue allows an attacker to perform actions on behalf of a user without their...

PT-2020-12739

Name of the Vulnerable Software and Affected Versions EJBCA versions prior to 6.15.2.6 EJBCA versions 7.x prior to 7.3.1.2 Description An issue was discovered in the External Command Certificate Validator, which allows administrators to upload external linters to validate certificates. This...

PT-2020-12741

Name of the Vulnerable Software and Affected Versions EJBCA versions prior to 6.15.2.6 EJBCA versions 7.x prior to 7.3.1.2 Description An issue allows a malicious user to generate an error state in the CA UI, which can be exploited to lead to privilege escalation and remote code execution. This i...

CVE-2020-11629: Insufficiently Protected Credentials

An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. The External Command Certificate Validator, which allows administrators to upload external linters to validate certificates, is supposed to save uploaded test certificates to the server. An attacker who has gained access to...

espace33.ca Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1132942 Security Researcher KhanJanny Helped patch 3050 vulnerabilities Received 9 Coordinated Disclosure badges Received 38 recommendations , a holder of 9 badges for responsible and coordinated disclosure, found a security vulnerability affecting espace33.ca website and...

EulerOS Virtualization for ARM 64 3.0.6.0 : python-pip (EulerOS-SA-2020-1354)

According to the versions of the python-pip package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request...

DEBIAN-CVE-2019-10221

A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from the pki-core server. This flaw is caused by missing sanitization of the GET URL parameters. An attacker could abuse this flaw to trick an authenticated user into clicking a...

UBUNTU-CVE-2019-10221

A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from the pki-core server. This flaw is caused by missing sanitization of the GET URL parameters. An attacker could abuse this flaw to trick an authenticated user into clicking a...

CVE-2019-10221

A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from the pki-core server. This flaw is caused by missing sanitization of the GET URL parameters. An attacker could abuse this flaw to trick an authenticated user into clicking a...

c11.ca Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1121009 Security Researcher NUMAN Helped patch 34 vulnerabilities Received 1 Coordinated Disclosure badges , a holder of 1 badges for responsible and coordinated disclosure, found a security vulnerability affecting c11.ca website and its users. Following coordinated and...

PT-2020-9059

Name of the Vulnerable Software and Affected Versions pki-core versions 10.x.x Description A Reflected Cross Site Scripting issue was found in the pki-ca module of the pki-core server, caused by missing sanitization of the GET URL parameters. An attacker could exploit this flaw to trick an...

CVE-2019-10221: Improper Neutralization of Input During Web Page Generation

A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from the pki-core server. This flaw is caused by missing sanitization of the GET URL parameters. An attacker could abuse this flaw to trick an authenticated user into clicking a...

Input validation

Data Protection Central versions 1.0, 1.0.1, 18.1, 18.2, and 19.1 contains an Improper Certificate Chain of Trust Vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by obtaining a CA signed certificate from Data Protection Central to impersonate a valid...

CVE-2019-3762

Data Protection Central versions 1.0, 1.0.1, 18.1, 18.2, and 19.1 contains an Improper Certificate Chain of Trust Vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by obtaining a CA signed certificate from Data Protection Central to impersonate a valid...

CVE-2019-10146

A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to the CA Agent Service not properly sanitizing the certificate request page. An attacker could inject a specially crafted value that will be executed on the victim's browser...

CVE-2019-10146

A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to the CA Agent Service not properly sanitizing the certificate request page. An attacker could inject a specially crafted value that will be executed on the victim's browser...