title: Red Hat Security Advisory: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update
description: jquery: Cross-site scripting via cross-domain ajax requests bootstrap: XSS in the data-target attribute bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip bootstrap: XSS in the tooltip or popover data-template attribute pki-core: Reflected XSS in 'path length' constraint field in CA's Agent page pki-core/pki-kra: Reflected XSS in recoveryID search field at KRA's DRM agent page in authorize recovery tab pki-core: Reflected XSS in getcookies?url= endpoint in CA jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection pki-core: KRA vulnerable to reflected XSS via the getPk12 page tomcat: Mishandling of Transfer-Encoding header allows for HTTP request smuggling tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods pki: Dogtag's python client does not validate certificates pki-core: XSS in the certificate search results tomcat: request mixup
cpes: cpe:/a:redhat:enterprise_linux:8::appstream