Vulmon
Recent Vulnerabilities
Product List
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
freeipa freeipa vulnerabilities and exploits
(subscribe to this query)
6.5
CVSSv3
CVE-2019-10195
A flaw was found in IPA, all 4.6.x versions prior to 4.6.7, all 4.7.x versions prior to 4.7.4 and all 4.8.x versions prior to 4.8.3, in the way that FreeIPA's batch processing API logged operations. This included passing user passwords in clear text on FreeIPA masters. Batch...
Freeipa Freeipa
Fedoraproject Fedora 30
Fedoraproject Fedora 31
2 Github repositories
5.9
CVSSv3
CVE-2021-3494
A smart proxy that provides a restful API to various sub-systems of the Foreman is affected by the flaw which can cause a Man-in-the-Middle attack. The FreeIPA module of Foreman smart proxy does not check the SSL certificate, thus, an unauthenticated attacker can perform actions ...
Theforeman Foreman
5.3
CVSSv3
CVE-2020-1722
A flaw was found in all ipa versions 4.x.x up to and including 4.8.0. When sending a very long password (>= 1,000,000 characters) to the server, the password hashing process could exhaust memory and CPU leading to a denial of service and the website becoming unresponsive. The ...
Freeipa Freeipa
Redhat Enterprise Linux 7.0
Redhat Enterprise Linux 6.0
Redhat Enterprise Linux 8.0
4.4
CVSSv3
CVE-2019-14826
A flaw was found in FreeIPA versions 4.5.0 and later. Session cookies were retained in the cache after logout. An attacker could abuse this flaw if they obtain previously valid session cookies and can use this to gain access to the session.
Freeipa Freeipa
Redhat Enterprise Linux 7.0
Redhat Enterprise Linux 8.0
2 Github repositories
NA
CVE-2024-3183
A vulnerability was found in FreeIPA in a way when a Kerberos TGS-REQ is encrypted using the client’s session key. This key is different for each new session, which protects it from brute force attacks. However, the ticket it contains is encrypted using the target principal...
NA
CVE-2024-2698
A vulnerability was found in FreeIPA in how the initial implementation of MS-SFU by MIT Kerberos was missing a condition for granting the "forwardable" flag on S4U2Self tickets. Fixing this mistake required adding a special case for the check_allowed_to_delegate() funct...
NA
CVE-2024-1481
A flaw was found in FreeIPA. This issue may allow a remote malicious user to craft a HTTP request with parameters that can be interpreted as command arguments to kinit on the FreeIPA server, which can lead to a denial of service.
NA
CVE-2015-1827
The get_user_grouplist function in the extdom plug-in in FreeIPA prior to 4.1.4 does not properly reallocate memory when processing user accounts, which allows remote malicious users to cause a denial of service (crash) via a group list request for a user that belongs to a large ...
Freeipa Freeipa
Fedoraproject Fedora 22
Fedoraproject Fedora 21
NA
CVE-2014-7850
Cross-site scripting (XSS) vulnerability in the Web UI in FreeIPA 4.x prior to 4.1.2 allows remote malicious users to inject arbitrary web script or HTML via vectors related to breadcrumb navigation.
Freeipa Freeipa 4.0.5
Freeipa Freeipa 4.1.1
Freeipa Freeipa 4.0.2
Freeipa Freeipa 4.0.0
Freeipa Freeipa 4.0.3
Freeipa Freeipa 4.1.0
Freeipa Freeipa 4.0.1
Freeipa Freeipa 4.0.4
NA
CVE-2014-7828
FreeIPA 4.0.x prior to 4.0.5 and 4.1.x prior to 4.1.1, when 2FA is enabled, allows remote malicious users to bypass the password requirement of the two-factor authentication leveraging an enabled OTP token, which triggers an anonymous bind.
Freeipa Freeipa 4.1.1
Freeipa Freeipa 4.0.2
Freeipa Freeipa 4.0.0
Freeipa Freeipa 4.0.3
Freeipa Freeipa 4.0.1
Freeipa Freeipa 4.0.4
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-37316
firmware
CVE-2024-30078
CVE-2024-5995
remote code execution
logic flaw
CVE-2024-20693
CVE-2024-37315
CVE-2024-5464
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
NEXT »