69 matches found
CVE-2021-40086
An issue was discovered in PrimeKey EJBCA before 7.6.0. As part of the configuration of the aliases for SCEP, CMP, EST, and Auto-enrollment, the enrollment secret was reflected on a page that can only be viewed by an administrator. While hidden from direct view, checking the page source would...
CVE-2021-40087
An issue was discovered in PrimeKey EJBCA before 7.6.0. When audit logging changes to the alias configurations of various protocols that use an enrollment secret, any modifications to the secret were logged in cleartext in the audit log that can only be viewed by an administrator. This affects us...
CVE-2021-40087
PrimeKey EJBCA before version 7.6.0 is affected by an issue where modifications to enrollment-secret alias configurations for protocols SCEP, CMP, and EST are logged in cleartext in the audit log (administrator-accessible). The vulnerability arises from audit logging changes to alias configuratio...
pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update
apache-commons-collections jss 4.8.1-2 - Bug 1932803 - HSM + FIPS: CMCRequest with a shared secret resulting in error 4.8.1-1 - Rebase to upstream JSS v4.8.1 - Red Hat Bugilla 1908541 - jss broke SCEP - missing PasswordChallenge class - Red Hat Bugilla 1489256 - RFE jss should support RSA with OA...
SUSE: Security Advisory (SUSE-SU-2019:3266-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Ensuring customers are protected from Solorigate
Microsoft is monitoring a dynamic threat environment surrounding the discovery of a sophisticated attack that included compromised binaries from a legitimate software. These binaries, which are related to the SolarWinds Orion Platform, could be used by attackers to remotely access devices. We hav...
Replay Attack
pki is vulnerable to replay attack. The certificate authority allowed the one-time PIN used in SCEP requests to be re-used. An attacker possessing a valid SCEP enrollment one-time PIN could use it to generate an unlimited number of certificates...
Unauthenticated Access
pki allows unauthenticated access. The certificate authority allowed unauthenticated users to request the one-time PIN in an SCEP request to be decrypted. An attacker able to sniff an SCEP request from a network device could request the certificate authority to decrypt the request, allowing them ...
SUSE SLED12 / SLES12 Security Update : strongswan (SUSE-SU-2019:3266-1)
This update for strongswan provides the following fixes : Security issues fixed : CVE-2018-5388: Fixed a buffer underflow which may allow to a remote attacker with local user credentials to resource exhaustion and denial of service while reading from the socket bsc1094462. CVE-2018-10811: Fixed a...
[SECURITY] Fedora 25 Update: sscep-0.6.1-5.20160525git2052ee1.fc25
Simple SCEP client with modifications for engine support & more...
[SECURITY] Fedora 26 Update: sscep-0.6.1-5.20160525git2052ee1.fc26
Simple SCEP client with modifications for engine support & more...
Microsoft Security Essentials / SCEP (Microsoft Windows 8/8.1/10 / Windows Server) - 'MsMpEng' Remote Type Confusion
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1252&desc=5 MsMpEng is the Malware Protection service that is enabled by default on Windows 8, 8.1, 10, Windows Server 2012, and so on. Additionally, Microsoft Security Essentials, System Centre Endpoint Protection and various othe...
Authentication flaw
An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the Simple Certificate Enrollment Protocol SCEP implementation in the "Profiles" component. It allows remote attackers to bypass cryptographic protection mechanisms by leveraging DES support...
CVE-2017-2380
CVE-2017-2380 affects iOS before 10.3 in the SCEP implementation within the Profiles component. The issue allows remote attackers to bypass cryptographic protections by leveraging DES support, enabling cryptographic protection circumvention via SCEP. Apple’s iOS 10.3 release addresses this by dep...
CVE-2017-2380
An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the Simple Certificate Enrollment Protocol SCEP implementation in the "Profiles" component. It allows remote attackers to bypass cryptographic protection mechanisms by leveraging DES support...
Fortinet FortiAuthenticator Cross-Site Scripting Vulnerability
Fortinet FortiAuthenticator is a series of secure authentication solutions that identify and interface with FortiToken™ two-factor authentication tokens for secure remote access. A cross-site scripting vulnerability in Fortinet FortiAuthenticator 3.0.0 could allow a remote attacker to inject...
CVE-2015-1459
Cross-site scripting XSS vulnerability in Fortinet FortiAuthenticator 3.0.0 allows remote attackers to inject arbitrary web script or HTML via the operation parameter to cert/scep/...
CVE-2015-1459
Cross-site scripting XSS vulnerability in Fortinet FortiAuthenticator 3.0.0 allows remote attackers to inject arbitrary web script or HTML via the operation parameter to cert/scep/...
Simple Certificate Enrollment Protocol (SCEP) does not strongly authenticate certificate requests
Overview Simple Certificate Enrollment Protocol SCEP does not strongly authenticate certificate requests made by users or devices. Update March 19, 2025: Solution section has been updated. Description IETF Internet-Draft draft-nourse-scep-23 "...defines a protocol, Simple Certificate Enrollment...