org.apache.syncope:syncope-core-upgrader (>=1.2.0-m1, <=1.2.10), org.apache.syncope:syncope-standalone (>=1.1.0, <=1.1.8) potentially affected by CVE-2018-1322 via org.apache.syncope:syncope-core (>=1.1.0, <=1.2.10)

org.apache.syncope:syncope-core MAVEN version =1.1.0, =1.2.0-m1, =1.1.0, =1.1.8 Source cves: CVE-2018-1322 Source advisory: OSV:GHSA-V3VF-2R98-XW8W...

GHSA-V3VF-2R98-XW8W Exposure of Sensitive Information to an Unauthorized Actor in Apache syncope-cope

An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11 and 2.0.x before 2.0.8 can recover sensitive security values using the fiql and orderby parameters...

org.apache.syncope:syncope-standalone (1.1.7) potentially affected by CVE-2018-17184 via org.apache.syncope:syncope-core (1.1.7)

org.apache.syncope:syncope-core MAVEN version 1.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-standalone 1.1.7 Source cves: CVE-2018-17184 Source advisory:...

org.apache.syncope:syncope-core-upgrader (1.2.7) potentially affected by CVE-2018-17184 via org.apache.syncope:syncope-core (1.2.7)

org.apache.syncope:syncope-core MAVEN version 1.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-core-upgrader 1.2.7 Source cves: CVE-2018-17184 Source advisory:...

org.apache.syncope:syncope-standalone (1.1.5) potentially affected by CVE-2018-17184 via org.apache.syncope:syncope-core (1.1.5)

org.apache.syncope:syncope-core MAVEN version 1.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-standalone 1.1.5 Source cves: CVE-2018-17184 Source advisory:...

org.apache.syncope:syncope-standalone (1.1.6) potentially affected by CVE-2018-17184 via org.apache.syncope:syncope-core (1.1.6)

org.apache.syncope:syncope-core MAVEN version 1.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-standalone 1.1.6 Source cves: CVE-2018-17184 Source advisory:...

org.apache.syncope:syncope-core-upgrader (1.2.10) potentially affected by CVE-2018-17184 via org.apache.syncope:syncope-core (1.2.10)

org.apache.syncope:syncope-core MAVEN version 1.2.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-core-upgrader 1.2.10 Source cves: CVE-2018-17184 Source advisory:...

org.apache.syncope:syncope-standalone (1.1.8) potentially affected by CVE-2018-17184 via org.apache.syncope:syncope-core (1.1.8)

org.apache.syncope:syncope-core MAVEN version 1.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-standalone 1.1.8 Source cves: CVE-2018-17184 Source advisory:...

org.apache.syncope:syncope-core-upgrader (1.2.0) potentially affected by CVE-2018-17184 via org.apache.syncope:syncope-core (1.2.0)

org.apache.syncope:syncope-core MAVEN version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-core-upgrader 1.2.0 Source cves: CVE-2018-17184 Source advisory:...

org.apache.syncope:syncope-core-upgrader (1.2.4) potentially affected by CVE-2018-17184 via org.apache.syncope:syncope-core (1.2.4)

org.apache.syncope:syncope-core MAVEN version 1.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-core-upgrader 1.2.4 Source cves: CVE-2018-17184 Source advisory:...

org.apache.syncope:syncope-core-upgrader (1.2.6) potentially affected by CVE-2018-17184 via org.apache.syncope:syncope-core (1.2.6)

org.apache.syncope:syncope-core MAVEN version 1.2.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-core-upgrader 1.2.6 Source cves: CVE-2018-17184 Source advisory:...

org.apache.syncope:syncope-standalone (1.1.0) potentially affected by CVE-2018-17184 via org.apache.syncope:syncope-core (1.1.0)

org.apache.syncope:syncope-core MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-standalone 1.1.0 Source cves: CVE-2018-17184 Source advisory:...

org.apache.syncope:syncope-core-upgrader (1.2.9) potentially affected by CVE-2018-17184 via org.apache.syncope:syncope-core (1.2.9)

org.apache.syncope:syncope-core MAVEN version 1.2.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-core-upgrader 1.2.9 Source cves: CVE-2018-17184 Source advisory:...

org.apache.syncope:syncope-core-upgrader (1.2.8) potentially affected by CVE-2018-17184 via org.apache.syncope:syncope-core (1.2.8)

org.apache.syncope:syncope-core MAVEN version 1.2.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-core-upgrader 1.2.8 Source cves: CVE-2018-17184 Source advisory:...

org.apache.syncope:syncope-standalone (1.1.4) potentially affected by CVE-2018-17184 via org.apache.syncope:syncope-core (1.1.4)

org.apache.syncope:syncope-core MAVEN version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-standalone 1.1.4 Source cves: CVE-2018-17184 Source advisory:...

Improper Control of Interaction Frequency in Apache syncope-core

A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector names, Report names, AnyTypeClass keys and Policy descriptions. When another user with enough administration entitlements edits one of the Entities above via Admi...

org.apache.syncope:syncope-core-upgrader (1.2.2) potentially affected by CVE-2018-17184 via org.apache.syncope:syncope-core (1.2.2)

org.apache.syncope:syncope-core MAVEN version 1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-core-upgrader 1.2.2 Source cves: CVE-2018-17184 Source advisory:...

org.apache.syncope:syncope-core-upgrader (1.2.0-m1) potentially affected by CVE-2018-17184 via org.apache.syncope:syncope-core (1.2.0-m1)

org.apache.syncope:syncope-core MAVEN version 1.2.0-m1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-core-upgrader 1.2.0-m1 Source cves: CVE-2018-17184 Source advisory:...

org.apache.syncope:syncope-core-upgrader (1.2.3) potentially affected by CVE-2018-17184 via org.apache.syncope:syncope-core (1.2.3)

org.apache.syncope:syncope-core MAVEN version 1.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-core-upgrader 1.2.3 Source cves: CVE-2018-17184 Source advisory:...

org.apache.syncope:syncope-core-upgrader (1.2.1) potentially affected by CVE-2018-17184 via org.apache.syncope:syncope-core (1.2.1)

org.apache.syncope:syncope-core MAVEN version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-core-upgrader 1.2.1 Source cves: CVE-2018-17184 Source advisory:...