Vulnerabilities > Fedoraproject > Sssd > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2019-12-26 | CVE-2012-3462 | Improper Authentication vulnerability in Fedoraproject Sssd 1.9.0 A flaw was found in SSSD version 1.9.0. | 6.5 |
| 2019-03-25 | CVE-2018-16838 | Improper Privilege Management vulnerability in multiple products A flaw was found in sssd Group Policy Objects implementation. | 5.4 |
| 2019-01-15 | CVE-2019-3811 | A vulnerability was found in sssd. | 5.2 |
| 2018-07-27 | CVE-2017-12173 | Improper Input Validation vulnerability in multiple products It was found that sssd's sysdb_search_user_by_upn_res() function before 1.16.0 did not sanitize requests when querying its local cache and was vulnerable to injection. | 4.0 |
| 2018-06-26 | CVE-2018-10852 | Information Exposure vulnerability in multiple products The UNIX pipe which sudo uses to contact SSSD and read the available sudo rules from SSSD has too wide permissions, which means that anyone who can send a message using the same raw protocol that sudo and SSSD use can read the sudo rules available for any user. | 5.0 |
| 2013-03-21 | CVE-2013-0287 | Permissions, Privileges, and Access Controls vulnerability in Fedoraproject Sssd The Simple Access Provider in System Security Services Daemon (SSSD) 1.9.0 through 1.9.4, when the Active Directory provider is used, does not properly enforce the simple_deny_groups option, which allows remote authenticated users to bypass intended access restrictions. | 4.9 |
| 2010-08-30 | CVE-2010-2940 | Improper Authentication vulnerability in Fedoraproject Sssd 1.3.0 The auth_send function in providers/ldap/ldap_auth.c in System Security Services Daemon (SSSD) 1.3.0, when LDAP authentication and anonymous bind are enabled, allows remote attackers to bypass the authentication requirements of pam_authenticate via an empty password. | 5.1 |