| CVE |
Vendors |
Products |
Updated |
CVSS |
| CVE-2019-14826 |
2 Freeipa, Redhat |
2 Freeipa, Enterprise Linux |
2019-10-09 |
2.1 |
| A flaw was found in FreeIPA versions 4.5.0 and later. Session cookies were retained in the cache after logout. An attacker could abuse this flaw if they obtain previously valid session cookies and can use this to gain access to the session. |
| CVE-2017-2590 |
2 Freeipa, Redhat |
7 Freeipa, Enterprise Linux, Enterprise Linux Desktop and 4 more |
2019-10-09 |
5.5 |
| A vulnerability was found in ipa before 4.4. IdM's ca-del, ca-disable, and ca-enable commands did not properly check the user's permissions while modifying CAs in Dogtag. An authenticated, unauthorized attacker could use this flaw to delete,... |
| CVE-2016-9575 |
1 Freeipa |
1 Freeipa |
2019-10-09 |
6.5 |
| Ipa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did not properly check the user's permissions while modifying certificate profiles in IdM's certprofile-mod command. An authenticated, unprivileged attacker could use this flaw to... |
| CVE-2017-12169 |
1 Freeipa |
1 Freeipa |
2018-04-17 |
4.0 |
| It was found that FreeIPA 4.2.0 and later could disclose password hashes to users having the 'System: Read Stage Users' permission. A remote, authenticated attacker could potentially use this flaw to disclose the password hashes belonging to... |
| CVE-2016-7030 |
1 Freeipa |
1 Freeipa |
2018-01-05 |
5.0 |
| FreeIPA uses a default password policy that locks an account after 5 unsuccessful authentication attempts, which allows remote attackers to cause a denial of service by locking out the account in which system services run on. |
| CVE-2017-11191 |
1 Freeipa |
1 Freeipa |
2017-10-11 |
6.5 |
| ** DISPUTED ** FreeIPA 4.x with API version 2.213 allows a remote authenticated users to bypass intended account-locking restrictions via an unlock action with an old session ID (for the same user account) that had been created for an earlier... |
| CVE-2015-5284 |
1 Freeipa |
1 Freeipa |
2017-10-04 |
5.0 |
| ipa-kra-install in FreeIPA before 4.2.2 puts the CA agent certificate and private key in /etc/httpd/alias/kra-agent.pem, which is world readable. |
| CVE-2015-5179 |
1 Freeipa |
1 Freeipa |
2017-10-03 |
5.0 |
| FreeIPA might display user data improperly via vectors involving non-printable characters. |
| CVE-2014-7828 |
1 Freeipa |
1 Freeipa |
2017-09-08 |
3.5 |
| FreeIPA 4.0.x before 4.0.5 and 4.1.x before 4.1.1, when 2FA is enabled, allows remote attackers to bypass the password requirement of the two-factor authentication leveraging an enabled OTP token, which triggers an anonymous bind. |
| CVE-2016-5414 |
1 Freeipa |
1 Freeipa |
2017-07-05 |
5.0 |
| FreeIPA 4.4.0 allows remote attackers to request an arbitrary SAN name for services. |
| CVE-2015-1827 |
2 Freeipa, Fedoraproject |
2 Fedora, Freeipa |
2016-12-31 |
5.0 |
| The get_user_grouplist function in the extdom plug-in in FreeIPA before 4.1.4 does not properly reallocate memory when processing user accounts, which allows remote attackers to cause a denial of service (crash) via a group list request for a... |
| CVE-2016-5404 |
3 Freeipa, Oracle, Fedoraproject |
3 Fedora, Freeipa, Linux |
2016-11-28 |
4.0 |
| The cert_revoke command in FreeIPA does not check for the "revoke certificate" permission, which allows remote authenticated users to revoke arbitrary certificates by leveraging the "retrieve certificate" permission. |
| CVE-2014-7850 |
1 Freeipa |
1 Freeipa |
2015-02-17 |
4.3 |
| Cross-site scripting (XSS) vulnerability in the Web UI in FreeIPA 4.x before 4.1.2 allows remote attackers to inject arbitrary web script or HTML via vectors related to breadcrumb navigation. |
