Keyfactor - vulnerabilities (CVEs)
12 CVEs in 7 products, 0 in the last 30 days, newest from 2025-12-22.
Products
- Signserver - 4 CVEs
- Command - 2 CVEs
- Ejbca - 2 CVEs
- Aws Orchestrator - 1 CVEs
- Kefactor Ejbca - 1 CVEs
- Primekey Ejbca - 1 CVEs
- Rg-ew5100be - 1 CVEs
Newest CVEs of Keyfactor
- CVE-2025-26787 - CVSS 4.7 (medium), 2025-12-22: An error in the SignServer container startup logic was found in Keyfactor SignServer versions prior to 7.2. The Admin CLI command used to configure…
- CVE-2025-47222 - CVSS 6.5 (medium), 2025-11-13: A class name enumeration was found in Keyfactor SignServer versions prior to 7.3.2. Setting any chosen class name to any of the properties requiring a class…
- CVE-2025-47221 - CVSS 5.3 (medium), 2025-11-13: An arbitrary file write was found in Keyfactor SignServer versions prior to 7.3.2. The properties ARCHIVETODISK_FILENAME-PATTERN, ARCHIVETODISK_PATH_BASE,…
- CVE-2025-47220 - CVSS 5.3 (medium), 2025-11-13: A local file enumeration was found in Keyfactor SignServer versions prior to 7.3.2 .The property VISIBLE_SIGNATURE_CUSTOM_IMAGE_PATH, which exists in the…
- CVE-2025-11073 - CVSS 5.1 (medium), 2025-09-27: A vulnerability was detected in Keyfactor RG-EW5100BE EW_3.0B11P280_EW5100BE-PRO_12183019. The affected element is an unknown function of the file…
- CVE-2024-36066 - CVSS 3.1 (low), 2024-09-12: The CMP CLI client in KeyFactor EJBCA before 8.3.1 has only 6 octets of salt, and is thus not compliant with the security requirements of RFC 4211, and might…
- CVE-2024-42006 - CVSS 7.5 (high), 2024-08-20: Keyfactor AWS Orchestrator through 2.0 allows Information Disclosure.
- CVE-2024-33872 - CVSS 9.8 (critical), 2024-08-20: Keyfactor Command 10.5.x before 10.5.1 and 11.5.x before 11.5.1 allows SQL Injection which could result in code execution and escalation of privileges.
- CVE-2024-34458 - CVSS 7.5 (high), 2024-08-20: Keyfactor Command 10.5.x before 10.5.1 and 11.5.x before 11.5.1 allows SQL Injection which could result in information disclosure.
- CVE-2023-34196 - CVSS 8.2 (high), 2023-08-03: In the Keyfactor EJBCA before 8.0.0, the RA web certificate distribution servlet /ejbca/ra/cert allows partial denial of service due to an authentication…
- CVE-2022-42954 - CVSS 5.4 (medium), 2022-11-17: Keyfactor EJBCA before 7.10.0 allows XSS.
- CVE-2022-39834 - CVSS 5.4 (medium), 2022-11-17: A stored XSS vulnerability was discovered in adminweb/ra/viewendentity.jsp in PrimeKey EJBCA through 7.9.0.2. A low-privilege user can store JavaScript in…
