861 matches found
EUVD-2026-72356
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI...
CVE-2026-76578
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI...
CVE-2026-76578
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI...
Linux Distros Unpatched Vulnerability : CVE-2026-79678
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval call before the...
Linux Distros Unpatched Vulnerability : CVE-2026-76578
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the...
PT-2026-86758
A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardless of privilege level, to enumerate an...
PT-2026-86757
A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI...
CVE-2022-2414-POC
CVE-2022-2414-POC Access to external entities when parsing XML documents can lead to XML external entity XXE attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests. It does...."potentially" confirmed...
CVE-2026-73197 vulnerabilities
Vulnerabilities for packages: freeipa...
CVE-2026-73198 vulnerabilities
Vulnerabilities for packages: freeipa...
GHSA-RVF3-5QRX-MRJ3 vulnerabilities
Vulnerabilities for packages: freeipa...
GHSA-6XG7-8FR6-8P33 vulnerabilities
Vulnerabilities for packages: freeipa...
CVE-2026-11861 vulnerabilities
Vulnerabilities for packages: freeipa...
CVE-2026-19550 vulnerabilities
Vulnerabilities for packages: freeipa...
GHSA-G67C-JG9C-RQH2 vulnerabilities
Vulnerabilities for packages: freeipa...
GHSA-M6VW-RCWJ-PG9Q vulnerabilities
Vulnerabilities for packages: freeipa...
GHSA-P44Q-GPJC-MGM9 vulnerabilities
Vulnerabilities for packages: freeipa...
CVE-2026-73196 vulnerabilities
Vulnerabilities for packages: freeipa...
CVE-2026-53683 Freeipa: idm: idm/freeipa web ui - client-side open redirect in reset_password.html
resetpassword.html parses query string parameters and uses the 'url' parameter as a redirection target window.location = url after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary...
CVE-2026-53683
FreeIPA Web UI is affected by a client-side open redirect in reset_password.html. The file parses the url query string parameter and assigns it directly to window.location after the password-reset workflow completes, without validation or allowlisting. This allows an attacker to redirect users to...