freeipa

Top products

The 15 most recently published vulnerabilities affecting freeipa.

• CVE-2024-2698Freeipa: delegation rules allow a proxy service to impersonate any user to access another target service8.8Jun 12, 2024
• CVE-2023-5455Ipa: invalid csrf protection6.5Jan 10, 2024
• CVE-2020-1722A flaw was found in all ipa versions 4.x.x through 4.8.0. When sending a very long password (>= 1,000,000 characters) to the server, the password hashing process could exhaust memory and CPU leadin...5.3Apr 27, 2020
• CVE-2019-14867A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way the internal function ber_scanf() was used in some componen...8.8Nov 27, 2019
• CVE-2019-10195A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way that FreeIPA's batch processing API logged operations. This...6.5Nov 27, 2019
• CVE-2012-5631ipa 3.0 does not properly check server identity before sending credential containing cookies8.8Nov 25, 2019
• CVE-2019-14826A flaw was found in FreeIPA versions 4.5.0 and later. Session cookies were retained in the cache after logout. An attacker could abuse this flaw if they obtain previously valid session cookies and ...4.4Sep 17, 2019
• CVE-2017-2590A vulnerability was found in ipa before 4.4. IdM's ca-del, ca-disable, and ca-enable commands did not properly check the user's permissions while modifying CAs in Dogtag. An authenticated, unauthor...8.1Jul 27, 2018
• CVE-2016-9575Ipa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did not properly check the user's permissions while modifying certificate profiles in IdM's certprofile-mod command. An authenticated, ...6.3Mar 13, 2018
• CVE-2017-12169It was found that FreeIPA 4.2.0 and later could disclose password hashes to users having the 'System: Read Stage Users' permission. A remote, authenticated attacker could potentially use this flaw ...7.5Jan 10, 2018
• CVE-2017-11191FreeIPA 4.x with API version 2.213 allows a remote authenticated users to bypass intended account-locking restrictions via an unlock action with an old session ID (for the same user account) that h...8.8Sep 27, 2017
• CVE-2015-5284ipa-kra-install in FreeIPA before 4.2.2 puts the CA agent certificate and private key in /etc/httpd/alias/kra-agent.pem, which is world readable.9.8Sep 21, 2017
• CVE-2015-5179FreeIPA might display user data improperly via vectors involving non-printable characters.7.5Sep 20, 2017
• CVE-2016-7030FreeIPA uses a default password policy that locks an account after 5 unsuccessful authentication attempts, which allows remote attackers to cause a denial of service by locking out the account in w...7.5Aug 28, 2017
• CVE-2016-5414FreeIPA 4.4.0 allows remote attackers to request an arbitrary SAN name for services.7.5Jun 27, 2017