Freeipa

freeipa

25 CVEs • 1 product

Products (1)

Click to collapse

Toggle

CVEs (25)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2016-5414 1Freeipa 1Freeipa May 13, 2026 Jun 27, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 FreeIPA 4.4.0 allows remote attackers to request an arbitrary SAN name for services.
CVE-2016-5404 3Fedoraproject FreeipaOracle 3Fedora FreeipaLinux May 6, 2026 Sep 7, 2016 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 The cert_revoke command in FreeIPA does not check for the "revoke certificate" permission, which allows remote authenticated users to revoke arbitrary certificates by leveraging the "retrieve certificate" permission.
CVE-2015-1827 2Fedoraproject Freeipa 2Fedora Freeipa May 6, 2026 Mar 30, 2015 N/A· v4 N/A· v3 5.0 MEDIUM· v2 The get_user_grouplist function in the extdom plug-in in FreeIPA before 4.1.4 does not properly reallocate memory when processing user accounts, which allows remote attackers to cause a denial of service (crash) via a gr...Show more The get_user_grouplist function in the extdom plug-in in FreeIPA before 4.1.4 does not properly reallocate memory when processing user accounts, which allows remote attackers to cause a denial of service (crash) via a group list request for a user that belongs to a large number of groups.Show less
CVE-2014-7850 1Freeipa 1Freeipa May 6, 2026 Nov 28, 2014 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in the Web UI in FreeIPA 4.x before 4.1.2 allows remote attackers to inject arbitrary web script or HTML via vectors related to breadcrumb navigation.
CVE-2014-7828 1Freeipa 1Freeipa May 6, 2026 Nov 19, 2014 N/A· v4 N/A· v3 3.5 LOW· v2 FreeIPA 4.0.x before 4.0.5 and 4.1.x before 4.1.1, when 2FA is enabled, allows remote attackers to bypass the password requirement of the two-factor authentication leveraging an enabled OTP token, which triggers an anony...Show more FreeIPA 4.0.x before 4.0.5 and 4.1.x before 4.1.1, when 2FA is enabled, allows remote attackers to bypass the password requirement of the two-factor authentication leveraging an enabled OTP token, which triggers an anonymous bind.Show less