Read the docs

Fedoraproject

Records5448All Threatist records
Exploited (KEV)89In CISA KEV
CVSS critical541CVSS 9.0–10.0
CVSS high2430CVSS 7.0–8.9

Exploited now

Fedoraproject records in CISA KEV
TI-2024-18448 Apple Multiple Products Improper Authentication Vulnerability Priority HIGH 82KEV 2026-11-04TI-2015-02923 ProFTPD Improper Access Control Vulnerability Priority CRITICAL 100KEV 2026-10-08TI-2015-04610 ISC BIND Data Processing Errors Vulnerability Priority CRITICAL 92KEV 2026-10-08TI-2022-00894 Linux Kernel Out-of-Bounds Write Vulnerability Priority CRITICAL 93KEV 2026-08-26TI-2022-00413 Linux Kernel Improper Authentication Vulnerability Priority CRITICAL 93KEV 2026-06-02TI-2021-11319 Apple Multiple Products Integer Overflow or Wraparound Vulnerability Priority CRITICAL 97KEV 2026-03-05

Components

Products in the NVD configurations · select one to filter the records
Fedora 5361 records CRITICAL Extra Packages For Enterprise Linux 76 records CRITICAL 389 Directory Server 39 records MEDIUM Sssd 36 records HIGH Fedora Core 8 records MEDIUM 389 Administration Server 1 record LOW Anaconda 1 record LOW Arm Installer 1 record LOW

Records

36 records in Sssd · all components

TI-2021-02567 CVE-2021-3621 · GHSA-g527-g4q2-57xc

Command injection in sssd

Priority MEDIUM 43

A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.02648 Published 2021-12-23 Partial fix CWE-77
TI-2017-08963 CVE-2017-12173 · GHSA-w83x-jcpq-6cr7

Improper input validation in sssd

Priority MEDIUM 41

It was found that sssd's sysdb_search_user_by_upn_res() function before 1.16.0 did not sanitize requests when querying its local cache and was vulnerable to injection.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01511 Published 2018-07-27 Partial fix CWE-20
TI-2012-02990 CVE-2012-3462 · GHSA-h73j-5p58-29r6

Improper authentication in sssd

Priority MEDIUM 41

A flaw was found in SSSD version 1.9.0.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01608 Published 2019-12-26 No fix listed CWE-287
TI-2018-07666 CVE-2018-10852 · GHSA-fw39-25vp-7459

Information disclosure in [UNKNOWN] sssd

Priority LOW 36

The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone who can send a message using the same raw protocol that sudo and SSSD use can re…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01458 Published 2018-06-26 Partial fix CWE-200
TI-2015-04448 CVE-2015-5292 · GHSA-5f57-m892-gf57

Memory leak in the Privilege Attribute Certificate (PAC) responder plugin…

Priority LOW 36

Memory leak in the Privilege Attribute Certificate (PAC) responder plugin (sssd_pac_plugin.so) in System Security Services Daemon (SSSD) 1.10 before 1.13.1 allows remote authenticated users to cause a denial of service (…

CVSS 2.0MEDIUM 6.8 Network Low privileges Interaction — EPSS 0.03666 Published 2015-10-29 Partial fix CWE-399
TI-2018-12048 CVE-2018-16838 · GHSA-h2vj-4wwx-54q4

Improper access control in [UNKNOWN] sssd

Priority LOW 27

A flaw was found in sssd Group Policy Objects implementation.

CVSS 3.0MEDIUM 5.4 Network Low privileges No interaction EPSS 0.01157 Published 2019-03-25 Fixed CWE-284
TI-2013-00218 CVE-2013-0287 · GHSA-h53f-x74p-cc2v

The Simple Access Provider in System Security Services Daemon (SSSD) 1.9.0 through 1.9.4…

Priority LOW 27

The Simple Access Provider in System Security Services Daemon (SSSD) 1.9.0 through 1.9.4, when the Active Directory provider is used, does not properly enforce the simple_deny_groups option, which allows remote authentic…

CVSS 2.0MEDIUM 4.9 Network Low privileges Interaction — EPSS 0.02154 Published 2013-03-21 Fixed CWE-264
TI-2010-02813 CVE-2010-2940 · GHSA-x9m9-3w3m-hrf4

The auth_send function in providers/ldap/ldap_auth.c in System Security Services Daemon…

Priority LOW 27

The auth_send function in providers/ldap/ldap_auth.c in System Security Services Daemon (SSSD) 1.3.0, when LDAP authentication and anonymous bind are enabled, allows remote attackers to bypass the authentication requirem…

CVSS 2.0MEDIUM 5.1 Network No auth Interaction — EPSS 0.02023 Published 2010-08-30 No fix listed CWE-287
TI-2019-02823 CVE-2019-3811 · GHSA-x3cx-wjrx-m7rj

Information disclosure in sssd

Priority LOW 25

A vulnerability was found in sssd.

CVSS 3.1MEDIUM 5.2 Adjacent network Low privileges User interaction EPSS 0.00702 Published 2019-01-15 Partial fix CWE-200
TI-2018-12093 CVE-2018-16883 · GHSA-4qf7-r2vx-jf49

Information disclosure in [UNKNOWN] sssd

Priority LOW 25

sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to the "allowed_uids" configuration parameter.

CVSS 3.0MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00385 Published 2018-12-19 Fix deferred CWE-200
Load more
Open these records in search →