CVE-2018-1321

Apache Syncope vulnerability CVE-2018-1321: An administrator with report and template entitlements can abuse XSLT to perform malicious operations (read/write files, execute code) in affected releases of Apache Syncope 1.2.x before 1.2.11 and 2.0.x before 2.0.8 (plus some unsupported 1.0/1.1 branc...

org.apache.syncope:syncope-core-upgrader (>=1.2.0-m1, <=1.2.10), org.apache.syncope:syncope-standalone (>=1.1.0, <=1.1.8) potentially affected by CVE-2018-1321 via org.apache.syncope:syncope-core (>=1.1.0, <=1.2.10)

org.apache.syncope:syncope-core MAVEN version =1.1.0, =1.2.0-m1, =1.1.0, =1.1.8 Source cves: CVE-2018-1321 Source advisory: MEND:CVE-2018-1321...

org.apache.syncope:syncope-core-upgrader (>=1.2.0-m1, <=1.2.10), org.apache.syncope:syncope-standalone (>=1.1.0, <=1.1.8) potentially affected by CVE-2018-1322 via org.apache.syncope:syncope-core (>=1.1.0, <=1.2.10)

org.apache.syncope:syncope-core MAVEN version =1.1.0, =1.2.0-m1, =1.1.0, =1.1.8 Source cves: CVE-2018-1322 Source advisory: MEND:CVE-2018-1322...

CVE-2018-1322

CVE-2018-1322 affects Apache Syncope: 1.2.x before 1.2.11, 2.0.x before 2.0.8, and some unsupported releases (1.0.x, 1.1.x). The vulnerability allows an administrator with user-search entitlements to recover sensitive security values by manipulating the fiql and orderby parameters. The provided d...

CVE-2018-1322

An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters...

CVE-2018-1322

An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters...

CVE-2018-1321

An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can use XSL Transformations XSLT to perform malicious operations, including but not limited to file read, file...

CVE-2018-1321

An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can use XSL Transformations XSLT to perform malicious operations, including but not limited to file read, file...

Information Disclosure

apache-syncope is vulnerable to information disclosure. A malicious administrator user with search permissions can gain access to sensitive information through queries with the ORDERBY argument...

Remote Code Execution (RCE)

apache-syncope is vulnerable to remote code execution RCE attacks. A malicious administrator user can with report and template permissions can use XSL Transformations XSLT to inject and execute arbitrary code...

PT-2018-11701

Name of the Vulnerable Software and Affected Versions Apache Syncope versions 1.0.x through 1.2.10 Apache Syncope versions 2.0.x through 2.0.7 Description An administrator with user search entitlements can recover sensitive security values using the fiql and orderby parameters. Recommendations Fo...

PT-2018-3348

Name of the Vulnerable Software and Affected Versions: Apache Syncope versions 1.0.x through 1.2.10 Apache Syncope versions 2.0.x through 2.0.7 Apache Syncope version 1.1.x Description: The issue is related to insufficient input validation in the implementation of XSLT technology in Apache Syncop...

CVE-2018-1322: Exposure of Sensitive Information to an Unauthorized Actor

An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters...

CVE-2018-1321: Improper Input Validation

An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can use XSL Transformations XSLT to perform malicious operations, including but not limited to file read, file...

[SECURITY] CVE-2014-3503 Apache Syncope

cve-2014-3503.txt.asc -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2014-3503: Insecure Random implementations used to generate passwords in Apache Syncope Severity: Major Vendor: The Apache Software Foundation Versions Affected: This vulnerability affects all versions of Apache Syncope 1.1.x...

CVE-2014-3503

Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack...

Default credentials

Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack...

CVE-2014-3503

Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack...

CVE-2014-3503

Apache Syncope 1.1.x before 1.1.8 is affected. The issue stems from using insecure Random implementations to generate user passwords, enabling remote attackers to guess passwords by brute force. The fixed version is 1.1.8 (Ad libitum); upgrading is advised. If upgrading is not possible, apply off...

CVE-2014-3503

Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack...