Cross-site scripting in Apache Syncome EndUser

It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the Enduser UI could execute javascript code from URL query string...

GHSA-P2RP-CMJQ-R7WM Shell command injection in Apache Syncope

In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow entitlements can use Shell Service Tasks to perform malicious operations, including but not limited to file read, file write, and code execution...

Shell command injection in Apache Syncope

In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow entitlements can use Shell Service Tasks to perform malicious operations, including but not limited to file read, file write, and code execution...

org.apache.syncope:syncope-standalone (1.1.6) potentially affected by CVE-2020-1959 via org.apache.syncope:syncope-core (1.1.6)

org.apache.syncope:syncope-core MAVEN version 1.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-standalone 1.1.6 Source cves: CVE-2020-1959 Source advisory:...

org.apache.syncope:syncope-core-upgrader (1.2.0-m1) potentially affected by CVE-2020-1959 via org.apache.syncope:syncope-core (1.2.0-m1)

org.apache.syncope:syncope-core MAVEN version 1.2.0-m1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-core-upgrader 1.2.0-m1 Source cves: CVE-2020-1959 Source advisory:...

org.apache.syncope:syncope-standalone (1.1.4) potentially affected by CVE-2020-1959 via org.apache.syncope:syncope-core (1.1.4)

org.apache.syncope:syncope-core MAVEN version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-standalone 1.1.4 Source cves: CVE-2020-1959 Source advisory:...

org.apache.syncope:syncope-standalone (1.1.2) potentially affected by CVE-2020-1959 via org.apache.syncope:syncope-core (1.1.2)

org.apache.syncope:syncope-core MAVEN version 1.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-standalone 1.1.2 Source cves: CVE-2020-1959 Source advisory:...

org.apache.syncope:syncope-standalone (1.1.3) potentially affected by CVE-2020-1959 via org.apache.syncope:syncope-core (1.1.3)

org.apache.syncope:syncope-core MAVEN version 1.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-standalone 1.1.3 Source cves: CVE-2020-1959 Source advisory:...

org.apache.syncope:syncope-standalone (1.1.7) potentially affected by CVE-2020-1959 via org.apache.syncope:syncope-core (1.1.7)

org.apache.syncope:syncope-core MAVEN version 1.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-standalone 1.1.7 Source cves: CVE-2020-1959 Source advisory:...

org.apache.syncope:syncope-standalone (1.1.8) potentially affected by CVE-2020-1959 via org.apache.syncope:syncope-core (1.1.8)

org.apache.syncope:syncope-core MAVEN version 1.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-standalone 1.1.8 Source cves: CVE-2020-1959 Source advisory:...

org.apache.syncope:syncope-core-upgrader (1.2.1) potentially affected by CVE-2020-1959 via org.apache.syncope:syncope-core (1.2.1)

org.apache.syncope:syncope-core MAVEN version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-core-upgrader 1.2.1 Source cves: CVE-2020-1959 Source advisory:...

org.apache.syncope:syncope-core-upgrader (1.2.6) potentially affected by CVE-2020-1959 via org.apache.syncope:syncope-core (1.2.6)

org.apache.syncope:syncope-core MAVEN version 1.2.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-core-upgrader 1.2.6 Source cves: CVE-2020-1959 Source advisory:...

org.apache.syncope:syncope-core-upgrader (1.2.8) potentially affected by CVE-2020-1959 via org.apache.syncope:syncope-core (1.2.8)

org.apache.syncope:syncope-core MAVEN version 1.2.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-core-upgrader 1.2.8 Source cves: CVE-2020-1959 Source advisory:...

org.apache.syncope:syncope-standalone (1.1.0) potentially affected by CVE-2020-1959 via org.apache.syncope:syncope-core (1.1.0)

org.apache.syncope:syncope-core MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-standalone 1.1.0 Source cves: CVE-2020-1959 Source advisory:...

org.apache.syncope:syncope-standalone (1.1.1) potentially affected by CVE-2020-1959 via org.apache.syncope:syncope-core (1.1.1)

org.apache.syncope:syncope-core MAVEN version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-standalone 1.1.1 Source cves: CVE-2020-1959 Source advisory:...

org.apache.syncope:syncope-standalone (1.1.5) potentially affected by CVE-2020-1959 via org.apache.syncope:syncope-core (1.1.5)

org.apache.syncope:syncope-core MAVEN version 1.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-standalone 1.1.5 Source cves: CVE-2020-1959 Source advisory:...

org.apache.syncope:syncope-core-upgrader (1.2.0) potentially affected by CVE-2020-1959 via org.apache.syncope:syncope-core (1.2.0)

org.apache.syncope:syncope-core MAVEN version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-core-upgrader 1.2.0 Source cves: CVE-2020-1959 Source advisory:...

org.apache.syncope:syncope-core-upgrader (1.2.2) potentially affected by CVE-2020-1959 via org.apache.syncope:syncope-core (1.2.2)

org.apache.syncope:syncope-core MAVEN version 1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-core-upgrader 1.2.2 Source cves: CVE-2020-1959 Source advisory:...

org.apache.syncope:syncope-core-upgrader (1.2.3) potentially affected by CVE-2020-1959 via org.apache.syncope:syncope-core (1.2.3)

org.apache.syncope:syncope-core MAVEN version 1.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-core-upgrader 1.2.3 Source cves: CVE-2020-1959 Source advisory:...

org.apache.syncope:syncope-core-upgrader (1.2.4) potentially affected by CVE-2020-1959 via org.apache.syncope:syncope-core (1.2.4)

org.apache.syncope:syncope-core MAVEN version 1.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-core-upgrader 1.2.4 Source cves: CVE-2020-1959 Source advisory:...