org.apache.syncope:syncope-standalone (1.1.3) potentially affected by CVE-2018-17186 via org.apache.syncope:syncope-core (1.1.3)

org.apache.syncope:syncope-core MAVEN version 1.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-standalone 1.1.3 Source cves: CVE-2018-17186 Source advisory:...

Improper Restriction of XML External Entity Reference in org.apache.syncope:syncope-core

An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, file write, and code execution...

org.apache.syncope:syncope-standalone (1.1.0) potentially affected by CVE-2018-17186 via org.apache.syncope:syncope-core (1.1.0)

org.apache.syncope:syncope-core MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-standalone 1.1.0 Source cves: CVE-2018-17186 Source advisory:...

org.apache.syncope:syncope-core-upgrader (1.2.10) potentially affected by CVE-2018-17186 via org.apache.syncope:syncope-core (1.2.10)

org.apache.syncope:syncope-core MAVEN version 1.2.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-core-upgrader 1.2.10 Source cves: CVE-2018-17186 Source advisory:...

org.apache.syncope:syncope-core-upgrader (1.2.11) potentially affected by CVE-2018-17186 via org.apache.syncope:syncope-core (1.2.11)

org.apache.syncope:syncope-core MAVEN version 1.2.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-core-upgrader 1.2.11 Source cves: CVE-2018-17186 Source advisory:...

org.apache.syncope:syncope-standalone (1.1.1) potentially affected by CVE-2018-17186 via org.apache.syncope:syncope-core (1.1.1)

org.apache.syncope:syncope-core MAVEN version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-standalone 1.1.1 Source cves: CVE-2018-17186 Source advisory:...

org.apache.syncope:syncope-standalone (1.1.2) potentially affected by CVE-2018-17186 via org.apache.syncope:syncope-core (1.1.2)

org.apache.syncope:syncope-core MAVEN version 1.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-standalone 1.1.2 Source cves: CVE-2018-17186 Source advisory:...

org.apache.syncope:syncope-standalone (1.1.4) potentially affected by CVE-2018-17186 via org.apache.syncope:syncope-core (1.1.4)

org.apache.syncope:syncope-core MAVEN version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-standalone 1.1.4 Source cves: CVE-2018-17186 Source advisory:...

org.apache.syncope:syncope-standalone (1.1.5) potentially affected by CVE-2018-17186 via org.apache.syncope:syncope-core (1.1.5)

org.apache.syncope:syncope-core MAVEN version 1.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-standalone 1.1.5 Source cves: CVE-2018-17186 Source advisory:...

org.apache.syncope:syncope-standalone (1.1.6) potentially affected by CVE-2018-17186 via org.apache.syncope:syncope-core (1.1.6)

org.apache.syncope:syncope-core MAVEN version 1.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-standalone 1.1.6 Source cves: CVE-2018-17186 Source advisory:...

org.apache.syncope:syncope-core-upgrader (1.2.0-m1) potentially affected by CVE-2018-17186 via org.apache.syncope:syncope-core (1.2.0-m1)

org.apache.syncope:syncope-core MAVEN version 1.2.0-m1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-core-upgrader 1.2.0-m1 Source cves: CVE-2018-17186 Source advisory:...

org.apache.syncope:syncope-core-upgrader (1.2.1) potentially affected by CVE-2018-17186 via org.apache.syncope:syncope-core (1.2.1)

org.apache.syncope:syncope-core MAVEN version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-core-upgrader 1.2.1 Source cves: CVE-2018-17186 Source advisory:...

org.apache.syncope:syncope-core-upgrader (1.2.2) potentially affected by CVE-2018-17186 via org.apache.syncope:syncope-core (1.2.2)

org.apache.syncope:syncope-core MAVEN version 1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-core-upgrader 1.2.2 Source cves: CVE-2018-17186 Source advisory:...

org.apache.syncope:syncope-core-upgrader (1.2.3) potentially affected by CVE-2018-17186 via org.apache.syncope:syncope-core (1.2.3)

org.apache.syncope:syncope-core MAVEN version 1.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-core-upgrader 1.2.3 Source cves: CVE-2018-17186 Source advisory:...

org.apache.syncope:syncope-core-upgrader (1.2.6) potentially affected by CVE-2018-17186 via org.apache.syncope:syncope-core (1.2.6)

org.apache.syncope:syncope-core MAVEN version 1.2.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-core-upgrader 1.2.6 Source cves: CVE-2018-17186 Source advisory:...

org.apache.syncope:syncope-core-upgrader (1.2.7) potentially affected by CVE-2018-17186 via org.apache.syncope:syncope-core (1.2.7)

org.apache.syncope:syncope-core MAVEN version 1.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-core-upgrader 1.2.7 Source cves: CVE-2018-17186 Source advisory:...

org.apache.syncope:syncope-core-upgrader (1.2.8) potentially affected by CVE-2018-17186 via org.apache.syncope:syncope-core (1.2.8)

org.apache.syncope:syncope-core MAVEN version 1.2.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-core-upgrader 1.2.8 Source cves: CVE-2018-17186 Source advisory:...

org.apache.syncope:syncope-standalone (1.1.8) potentially affected by CVE-2018-17186 via org.apache.syncope:syncope-core (1.1.8)

org.apache.syncope:syncope-core MAVEN version 1.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-standalone 1.1.8 Source cves: CVE-2018-17186 Source advisory:...

org.apache.syncope:syncope-core-upgrader (1.2.9) potentially affected by CVE-2018-17186 via org.apache.syncope:syncope-core (1.2.9)

org.apache.syncope:syncope-core MAVEN version 1.2.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-core-upgrader 1.2.9 Source cves: CVE-2018-17186 Source advisory:...

Apache Syncope 2.0.7 Remote Code Execution

Exploit Title: Apache Syncope 2.0.7 - Remote Code Execution Date: 2018-09-12 Exploit Author: Che-Chun Kuo Vendor Homepage: https://syncope.apache.org/ Software Link: http://archive.apache.org/dist/syncope/ Version: 2.0.7 Tested on: Windows Advisory: https://syncope.apache.org/security CVE:...