Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
20 results
Mar 31, 2025The vulnerability exists in the EJBCA service, version 8.0 Enterprise.CVE-2025-3027 · Other software · PrimeKey Solutions AB · reported by cve-coordination@incibe.esMedium 5.1
The vulnerability exists in the EJBCA service, version 8.0 Enterprise. By making a small change to the PATH of the URL associated with the service, the server fails to find the requested file and redirects to an external page. This vulnerability could allow users to be redirected to potentially malicious external sites, which can be exploited for phishing or other social engineering attacks.
- Product
- EJBCA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025The vulnerability exists in the EJBCA service, version 8.0 Enterprise.CVE-2025-3026 · Other software · PrimeKey Solutions AB · reported by cve-coordination@incibe.esMedium 5.1
The vulnerability exists in the EJBCA service, version 8.0 Enterprise. Not tested in higher versions. By modifying the ‘Host’ header in an HTTP request, it is possible to manipulate the generated links and thus redirect the client to a different base URL. In this way, an attacker could insert his own server for the client to send HTTP requests, provided he succeeds in exploiting it.
- Product
- EJBCA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 12, 2024The CMP CLI client in KeyFactor EJBCA before 8.3.1 has only 6 octets of salt, and is thus not compliant with the security requirements of RFC 4211, and might maCVE-2024-36066 · Other software · Keyfactor · reported by MITRELow 3.1
The CMP CLI client in KeyFactor EJBCA before 8.3.1 has only 6 octets of salt, and is thus not compliant with the security requirements of RFC 4211, and might make man-in-the-middle attacks easier. CMP includes password-based MAC as one of the options for message integrity and authentication (the other option is certificate-based). RFC 4211 section 4.4 requires that password-based MAC parameters use a salt with a random value of at least 8 octets. This helps to inhibit dictionary attacks. Because the standalone CMP client originally was developed as test code, the salt was instead hardcoded and only 6 octets long.
- Product
- Ejbca
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddatatracker.ietf.orgsupport.keyfactor.com
Aug 2, 2023In the Keyfactor EJBCA before 8.0.0, the RA web certificate distribution servlet /ejbca/ra/cert allows partial denial of service due to an authentication issue.CVE-2023-34196 · Other software · Keyfactor · reported by MITREHigh 8.2
In the Keyfactor EJBCA before 8.0.0, the RA web certificate distribution servlet /ejbca/ra/cert allows partial denial of service due to an authentication issue. In configurations using OAuth, disclosure of CA certificates (attributes and public keys) to unauthenticated or less privileged users may occur.
- Product
- Ejbca
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkeyfactor.comsupport.keyfactor.com
Jan 1, 2023PrimeKey EJBCA 7.9.0.2 Community allows stored XSS in the End Entity section.CVE-2022-40711 · Other software · Primekey · reported by MITREMedium 4.8
PrimeKey EJBCA 7.9.0.2 Community allows stored XSS in the End Entity section. A user with the RA Administrator role can inject an XSS payload to target higher-privilege users.
- Product
- Ejbca
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordverneet.comverneet.com
Nov 17, 2022Keyfactor EJBCA before 7.10.0 allows XSS.CVE-2022-42954 · Other software · Keyfactor · reported by MITREMedium 5.4
Keyfactor EJBCA before 7.10.0 allows XSS.
- Product
- Kefactor Ejbca
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.keyfactor.comsupport.keyfactor.com
Nov 17, 2022A stored XSS vulnerability was discovered in adminweb/ra/viewendentity.jsp in PrimeKey EJBCA through 7.9.0.2.CVE-2022-39834 · Other software · Keyfactor · reported by MITREMedium 5.4
A stored XSS vulnerability was discovered in adminweb/ra/viewendentity.jsp in PrimeKey EJBCA through 7.9.0.2. A low-privilege user can store JavaScript in order to exploit a higher-privilege user.
- Product
- Primekey Ejbca
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.keyfactor.comsupport.keyfactor.com
Sep 13, 2022An issue was discovered in Keyfactor PrimeKey EJBCA before 7.9.0, related to possible inconsistencies in DNS identifiers submitted in an ACME order and the corrCVE-2022-34831 · Other software · Primekey · reported by MITRECritical 9.8
An issue was discovered in Keyfactor PrimeKey EJBCA before 7.9.0, related to possible inconsistencies in DNS identifiers submitted in an ACME order and the corresponding CSR submitted during finalization. During the ACME enrollment process, an order is submitted containing an identifier for one or multiple dnsNames. These are validated properly in the ACME challenge. However, if the validation passes, a non-compliant client can include additional dnsNames the CSR sent to the finalize endpoint, resulting in EJBCA issuing a certificate including the identifiers that were not validated. This occurs even if the certificate profile is configured to not allow a DN override by the CSR.
- Product
- Ejbca
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.keyfactor.comprimekey.com
Aug 24, 2021An issue was discovered in PrimeKey EJBCA before 7.6.0.CVE-2021-40089 · Other software · Primekey · reported by MITRELow 2.3
An issue was discovered in PrimeKey EJBCA before 7.6.0. The General Purpose Custom Publisher, which is normally run to invoke a local script upon a publishing operation, was still able to run if the System Configuration setting Enable External Script Access was disabled. With this setting disabled it's not possible to create new such publishers, but existing publishers would continue to run.
- Product
- Ejbca
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.primekey.comsupport.primekey.com
Aug 24, 2021An issue was discovered in PrimeKey EJBCA before 7.6.0.CVE-2021-40088 · Other software · Primekey · reported by MITREMedium 5.4
An issue was discovered in PrimeKey EJBCA before 7.6.0. CMP RA Mode can be configured to use a known client certificate to authenticate enrolling clients. The same RA client certificate is used for revocation requests as well. While enrollment enforces multi tenancy constraints (by verifying that the client certificate has access to the CA and Profiles being enrolled against), this check was not performed when authenticating revocation operations, allowing a known tenant to revoke a certificate belonging to another tenant.
- Product
- Ejbca
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.primekey.comsupport.primekey.com
Aug 24, 2021An issue was discovered in PrimeKey EJBCA before 7.6.0.CVE-2021-40087 · Other software · Primekey · reported by MITRELow 2.7
An issue was discovered in PrimeKey EJBCA before 7.6.0. When audit logging changes to the alias configurations of various protocols that use an enrollment secret, any modifications to the secret were logged in cleartext in the audit log (that can only be viewed by an administrator). This affects use of any of the following protocols: SCEP, CMP, or EST.
- Product
- Ejbca
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.primekey.comsupport.primekey.com
Aug 24, 2021An issue was discovered in PrimeKey EJBCA before 7.6.0.CVE-2021-40086 · Other software · Primekey · reported by MITRELow 2.2
An issue was discovered in PrimeKey EJBCA before 7.6.0. As part of the configuration of the aliases for SCEP, CMP, EST, and Auto-enrollment, the enrollment secret was reflected on a page (that can only be viewed by an administrator). While hidden from direct view, checking the page source would reveal the secret.
- Product
- Ejbca
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.primekey.comsupport.primekey.com
Nov 19, 2020An issue exists in PrimeKey EJBCA before 7.4.3 when enrolling with EST while proxied through an RA over the Peers protocol.CVE-2020-28942 · Other software · Primekey · reported by MITREMedium 4.3
An issue exists in PrimeKey EJBCA before 7.4.3 when enrolling with EST while proxied through an RA over the Peers protocol. As a part of EJBCA's domain security model, the peer connector allows the restriction of client certificates (for the RA, not the end user) to a limited set of allowed CAs, thus restricting the accessibility of that RA to the rights it has within a specific role. While this works for other protocols such as CMP, it was found that the EJBCA enrollment over an EST implementation bypasses this check, allowing enrollment with a valid client certificate through any functioning and authenticated RA connected to the CA. NOTE: an attacker must already have a trusted client certificate and authorization to enroll against the targeted CA.
- Product
- Ejbca
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.primekey.comsupport.primekey.com
Sep 11, 2020An issue was discovered in PrimeKey EJBCA 6.x and 7.x before 7.4.1.CVE-2020-25276 · Other software · Primekey · reported by MITREHigh 7.3
An issue was discovered in PrimeKey EJBCA 6.x and 7.x before 7.4.1. When using a client certificate to enroll over the EST protocol, no revocation check is performed on that certificate. This vulnerability can only affect a system that has EST configured, uses client certificates to authenticate enrollment, and has had such a certificate revoked. This certificate needs to belong to a role that is authorized to enroll new end entities. (To completely mitigate this problem prior to upgrade, remove any revoked client certificates from their respective roles.)
- Product
- Ejbca
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.primekey.comsupport.primekey.com
Apr 7, 2020An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2.CVE-2020-11631 · Other software · Primekey · reported by MITREMedium 6.5
An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. An error state can be generated in the CA UI by a malicious user. This, in turn, allows exploitation of other bugs. This follow-on exploitation can lead to privilege escalation and remote code execution. (This is exploitable only when at least one accessible port lacks a requirement for client certificate authentication. These ports are 8442 or 8080 in a standard installation.)
- Product
- Ejbca
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.primekey.comsupport.primekey.com
Apr 7, 2020An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2.CVE-2020-11630 · Other software · Primekey · reported by MITRECritical 9.8
An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. In several sections of code, the verification of serialized objects sent between nodes (connected via the Peers protocol) allows insecure objects to be deserialized.
- Product
- Ejbca
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.primekey.comsupport.primekey.com
Apr 7, 2020An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2.CVE-2020-11629 · Other software · Primekey · reported by MITREHigh 7.2
An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. The External Command Certificate Validator, which allows administrators to upload external linters to validate certificates, is supposed to save uploaded test certificates to the server. An attacker who has gained access to the CA UI could exploit this to upload malicious scripts to the server. (Risks associated with this issue alone are negligible unless a malicious user already has gained access to the CA UI through other means, as a trusted user is already trusted to upload scripts by virtue of having access to the validator.)
- Product
- Ejbca
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.primekey.comsupport.primekey.com
Apr 7, 2020An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2.CVE-2020-11628 · Other software · Primekey · reported by MITREMedium 5.3
An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. It is intended to support restriction of available remote protocols (CMP, ACME, REST, etc.) through the system configuration. These restrictions can be bypassed by modifying the URI string from a client. (EJBCA's internal access control restrictions are still in place, and each respective protocol must be configured to allow for enrollment.)
- Product
- Ejbca
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.primekey.comsupport.primekey.com
Apr 7, 2020An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2.CVE-2020-11627 · Other software · Primekey · reported by MITREHigh 8.8
An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. A Cross Site Request Forgery (CSRF) issue has been found in the CA UI.
- Product
- Ejbca
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.primekey.comsupport.primekey.com
Apr 7, 2020An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2.CVE-2020-11626 · Other software · Primekey · reported by MITREMedium 6.1
An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. Two Cross Side Scripting (XSS) vulnerabilities have been found in the Public Web and the Certificate/CRL download servlets.
- Product
- Ejbca
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.primekey.comsupport.primekey.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.