← Back

Freeipa

freeipa

Vendor: Freeipa • 25 CVEs

CVEs (25)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2016-5414
1Freeipa
1Freeipa
May 13, 2026
Jun 27, 2017
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
FreeIPA 4.4.0 allows remote attackers to request an arbitrary SAN name for services.
CVE-2016-5404
3Fedoraproject
FreeipaOracle
3Fedora
FreeipaLinux
May 6, 2026
Sep 7, 2016
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
The cert_revoke command in FreeIPA does not check for the "revoke certificate" permission, which allows remote authenticated users to revoke arbitrary certificates by leveraging the "retrieve certificate" permission.
CVE-2015-1827
2Fedoraproject
Freeipa
2Fedora
Freeipa
May 6, 2026
Mar 30, 2015
N/A· v4
N/A· v3
5.0 MEDIUM· v2
The get_user_grouplist function in the extdom plug-in in FreeIPA before 4.1.4 does not properly reallocate memory when processing user accounts, which allows remote attackers to cause a denial of service (crash) via a gr...Show more
The get_user_grouplist function in the extdom plug-in in FreeIPA before 4.1.4 does not properly reallocate memory when processing user accounts, which allows remote attackers to cause a denial of service (crash) via a group list request for a user that belongs to a large number of groups.Show less
CVE-2014-7850
1Freeipa
1Freeipa
May 6, 2026
Nov 28, 2014
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in the Web UI in FreeIPA 4.x before 4.1.2 allows remote attackers to inject arbitrary web script or HTML via vectors related to breadcrumb navigation.
CVE-2014-7828
1Freeipa
1Freeipa
May 6, 2026
Nov 19, 2014
N/A· v4
N/A· v3
3.5 LOW· v2
FreeIPA 4.0.x before 4.0.5 and 4.1.x before 4.1.1, when 2FA is enabled, allows remote attackers to bypass the password requirement of the two-factor authentication leveraging an enabled OTP token, which triggers an anony...Show more
FreeIPA 4.0.x before 4.0.5 and 4.1.x before 4.1.1, when 2FA is enabled, allows remote attackers to bypass the password requirement of the two-factor authentication leveraging an enabled OTP token, which triggers an anonymous bind.Show less