https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 09:37:34 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-43139 EUVD-2026-43139 https://cve.radiocsirt.org/vuln/euvd-2026-43139 https://cve.radiocsirt.org/vuln/fkie_cve-2020-15720 <p>In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation. Since the verify parameter was hard-coded in all request functions, it was not possible to override the setting. As a result, tools making use of this class, such as the pki-server command, may have been vulnerable to Person-in-the-Middle attacks in certain non-localhost use cases. This is fixed in 10.9.0-b1.</p> <p>In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation. Since the verify parameter was hard-coded in all request functions, it was not possible to override the setting. As a result, tools making use of this class, such as the pki-server command, may have been vulnerable to Person-in-the-Middle attacks in certain non-localhost use cases. This is fixed in 10.9.0-b1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2020-15720 https://cve.radiocsirt.org/vuln/ghsa-hpcm-hcj8-c96c <p>In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation. Since the verify parameter was hard-coded in all request functions, it was not possible to override the setting. As a result, tools making use of this class, such as the pki-server command, may have been vulnerable to Person-in-the-Middle attacks in certain non-localhost use cases. This is fixed in 10.9.0-b1.</p> <p>In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation. Since the verify parameter was hard-coded in all request functions, it was not possible to override the setting. As a result, tools making use of this class, such as the pki-server command, may have been vulnerable to Person-in-the-Middle attacks in certain non-localhost use cases. This is fixed in 10.9.0-b1.</p> https://cve.radiocsirt.org/vuln/ghsa-hpcm-hcj8-c96c https://cve.radiocsirt.org/vuln/gsd-2020-15720 gsd-2020-15720 https://cve.radiocsirt.org/vuln/gsd-2020-15720 https://cve.radiocsirt.org/vuln/rhsa-2020:4847 <p>jquery: Cross-site scripting via cross-domain ajax requests bootstrap: XSS in the data-target attribute bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip bootstrap: XSS in the tooltip or popover data-template attribute pki-core: Reflected XSS in &#39;path length&#39; constraint field in CA&#39;s Agent page pki-core/pki-kra: Reflected XSS in recoveryID search field at KRA&#39;s DRM agent page in authorize recovery tab pki-core: Reflected XSS in getcookies?url= endpoint in CA jquery: Prototype pollution in object&#39;s prototype leading to denial of service, remote code execution, or property injection pki-core: KRA vulnerable to reflected XSS via the getPk12 page tomcat: Mishandling of Transfer-Encoding header allows for HTTP request smuggling tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method jquery: Untrusted code execution via &lt;option&gt; tag in HTML passed to DOM manipulation methods pki: Dogtag&#39;s python client does not validate certificates pki-core: XSS in the certificate search results tomcat: request mixup</p> <p>jquery: Cross-site scripting via cross-domain ajax requests bootstrap: XSS in the data-target attribute bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip bootstrap: XSS in the tooltip or popover data-template attribute pki-core: Reflected XSS in &#39;path length&#39; constraint field in CA&#39;s Agent page pki-core/pki-kra: Reflected XSS in recoveryID search field at KRA&#39;s DRM agent page in authorize recovery tab pki-core: Reflected XSS in getcookies?url= endpoint in CA jquery: Prototype pollution in object&#39;s prototype leading to denial of service, remote code execution, or property injection pki-core: KRA vulnerable to reflected XSS via the getPk12 page tomcat: Mishandling of Transfer-Encoding header allows for HTTP request smuggling tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method jquery: Untrusted code execution via &lt;option&gt; tag in HTML passed to DOM manipulation methods pki: Dogtag&#39;s python client does not validate certificates pki-core: XSS in the certificate search results tomcat: request mixup</p> https://cve.radiocsirt.org/vuln/rhsa-2020:4847 https://cve.radiocsirt.org/vuln/ubuntu-cve-2020-15720 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: dogtag-pki, Ubuntu:Pro:18.04:LTS: dogtag-pki</p> <p>In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation. Since the verify parameter was hard-coded in all request functions, it was not possible to override the setting. As a result, tools making use of this class, such as the pki-server command, may have been vulnerable to Person-in-the-Middle attacks in certain non-localhost use cases. This is fixed in 10.9.0-b1.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: dogtag-pki, Ubuntu:Pro:18.04:LTS: dogtag-pki</p> <p>In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation. Since the verify parameter was hard-coded in all request functions, it was not possible to override the setting. As a result, tools making use of this class, such as the pki-server command, may have been vulnerable to Person-in-the-Middle attacks in certain non-localhost use cases. This is fixed in 10.9.0-b1.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2020-15720