CVE-2024-2698 | High | 8.8 | 2024-06-12 | A vulnerability was found in FreeIPA in how the initial implementation of MS-SFU by MIT Kerberos was missing a condition for granting the "forwardable" flag on… |
CVE-2023-5455 | Medium | 6.5 | 2024-01-10 | A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the use… |
CVE-2020-1722 | Medium | 5.3 | 2020-04-27 | A flaw was found in all ipa versions 4.x.x through 4.8.0. When sending a very long password (>= 1,000,000 characters) to the server, the password hashing proce… |
CVE-2019-14867 | High | 8.8 | 2019-11-27 | A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way the internal function… |
CVE-2019-10195 | Medium | 6.5 | 2019-11-27 | A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way that FreeIPA's batch… |
CVE-2012-5631 | High | 8.8 | 2019-11-25 | ipa 3.0 does not properly check server identity before sending credential containing cookies |
CVE-2019-14826 | Medium | 4.4 | 2019-09-17 | A flaw was found in FreeIPA versions 4.5.0 and later. Session cookies were retained in the cache after logout. An attacker could abuse this flaw if they obtain… |
CVE-2017-2590 | High | 8.1 | 2018-07-27 | A vulnerability was found in ipa before 4.4. IdM's ca-del, ca-disable, and ca-enable commands did not properly check the user's permissions while modifying CAs… |
CVE-2016-9575 | Medium | 6.3 | 2018-03-13 | Ipa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did not properly check the user's permissions while modifying certificate profiles in IdM's certp… |
CVE-2017-12169 | High | 7.5 | 2018-01-10 | It was found that FreeIPA 4.2.0 and later could disclose password hashes to users having the 'System: Read Stage Users' permission. A remote, authenticated att… |
CVE-2017-11191 | High | 8.8 | 2017-09-28 | FreeIPA 4.x with API version 2.213 allows a remote authenticated users to bypass intended account-locking restrictions via an unlock action with an old session… |
CVE-2015-5284 | Critical | 9.8 | 2017-09-21 | ipa-kra-install in FreeIPA before 4.2.2 puts the CA agent certificate and private key in /etc/httpd/alias/kra-agent.pem, which is world readable. |
CVE-2015-5179 | High | 7.5 | 2017-09-20 | FreeIPA might display user data improperly via vectors involving non-printable characters. |
CVE-2016-7030 | High | 7.5 | 2017-08-28 | FreeIPA uses a default password policy that locks an account after 5 unsuccessful authentication attempts, which allows remote attackers to cause a denial of s… |
CVE-2016-5414 | High | 7.5 | 2017-06-27 | FreeIPA 4.4.0 allows remote attackers to request an arbitrary SAN name for services. |
CVE-2016-5404 | Medium | 6.5 | 2016-09-07 | The cert_revoke command in FreeIPA does not check for the "revoke certificate" permission, which allows remote authenticated users to revoke arbitrary certific… |
CVE-2015-1827 | | | 2015-03-30 | The get_user_grouplist function in the extdom plug-in in FreeIPA before 4.1.4 does not properly reallocate memory when processing user accounts, which allows r… |
CVE-2014-7850 | | | 2014-11-28 | Cross-site scripting (XSS) vulnerability in the Web UI in FreeIPA 4.x before 4.1.2 allows remote attackers to inject arbitrary web script or HTML via vectors r… |
CVE-2014-7828 | | | 2014-11-19 | FreeIPA 4.0.x before 4.0.5 and 4.1.x before 4.1.1, when 2FA is enabled, allows remote attackers to bypass the password requirement of the two-factor authentica… |