GHSA-6QJ8-C27W-RP33 Cross-site scripting in Apache Syncome EndUser

It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the Enduser UI could execute javascript code from URL query string...

Cross-site scripting in Apache Syncome EndUser

It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the Enduser UI could execute javascript code from URL query string...

org.apache.syncope.ext.flowable:syncope-ext-flowable-client-enduser (>=2.1.3, <=2.1.5), org.apache.syncope.ext.oidcclient:syncope-ext-oidcclient-client-enduser (>=2.1.0, <=2.1.5) +1 more potentially affected by CVE-2019-17557 via org.apache.syncope.client:syncope-client-enduser (>=2.1.0, <=2.1.5)

org.apache.syncope.client:syncope-client-enduser MAVEN version =2.1.0, =2.1.3, =2.1.0, =2.1.0, =2.1.5 Source cves: CVE-2019-17557 Source advisory: OSV:GHSA-6QJ8-C27W-RP33...

Shell command injection in Apache Syncope

In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow entitlements can use Shell Service Tasks to perform malicious operations, including but not limited to file read, file write, and code execution...

GHSA-P2RP-CMJQ-R7WM Shell command injection in Apache Syncope

In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow entitlements can use Shell Service Tasks to perform malicious operations, including but not limited to file read, file write, and code execution...

org.apache.syncope:syncope-standalone (1.1.8) potentially affected by CVE-2020-1959 via org.apache.syncope:syncope-core (1.1.8)

org.apache.syncope:syncope-core MAVEN version 1.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-standalone 1.1.8 Source cves: CVE-2020-1959 Source advisory:...

Expression Language Injection in Apache Syncope

A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary Java EL expressions, leading to an unauthenticated Remote Code Execution RCE vulnerability. Apache Syncope uses Java Bean Validation JSR 380 custom constraint validators. When...

org.apache.syncope:syncope-core-upgrader (1.2.8) potentially affected by CVE-2020-1959 via org.apache.syncope:syncope-core (1.2.8)

org.apache.syncope:syncope-core MAVEN version 1.2.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-core-upgrader 1.2.8 Source cves: CVE-2020-1959 Source advisory:...

org.apache.syncope:syncope-core-upgrader (1.2.6) potentially affected by CVE-2020-1959 via org.apache.syncope:syncope-core (1.2.6)

org.apache.syncope:syncope-core MAVEN version 1.2.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-core-upgrader 1.2.6 Source cves: CVE-2020-1959 Source advisory:...

GHSA-VJQW-R3WW-WJ2W Expression Language Injection in Apache Syncope

A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary Java EL expressions, leading to an unauthenticated Remote Code Execution RCE vulnerability. Apache Syncope uses Java Bean Validation JSR 380 custom constraint validators. When...

org.apache.syncope:syncope-standalone (1.1.1) potentially affected by CVE-2020-1959 via org.apache.syncope:syncope-core (1.1.1)

org.apache.syncope:syncope-core MAVEN version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-standalone 1.1.1 Source cves: CVE-2020-1959 Source advisory:...

org.apache.syncope:syncope-core-upgrader (1.2.4) potentially affected by CVE-2020-1959 via org.apache.syncope:syncope-core (1.2.4)

org.apache.syncope:syncope-core MAVEN version 1.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-core-upgrader 1.2.4 Source cves: CVE-2020-1959 Source advisory:...

org.apache.syncope:syncope-core-upgrader (1.2.3) potentially affected by CVE-2020-1959 via org.apache.syncope:syncope-core (1.2.3)

org.apache.syncope:syncope-core MAVEN version 1.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-core-upgrader 1.2.3 Source cves: CVE-2020-1959 Source advisory:...

GHSA-4W4P-XWRR-9CRH Injection in Apache Syncope

Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to 2.1.6, enabling attackers to inject arbitrary JEXL expressions, leading to Remote Code Execution RCE was discovered...

Injection in Apache Syncope

Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to 2.1.6, enabling attackers to inject arbitrary JEXL expressions, leading to Remote Code Execution RCE was discovered...

Apache Syncope Remote Code Execution Vulnerability (CNVD-2020-52391)

Apache Syncope is the United States Apache Apache Foundation's set of open source digital identity management system for use in enterprise environments. The system supports identity management, role configuration and more. A security vulnerability exists in Apache Syncope 2.1.x prior to 2.1.7. An...

CVE-2020-11977

In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow entitlements can use Shell Service Tasks to perform malicious operations, including but not limited to file read, file write, and code execution...

CVE-2020-11977

In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow entitlements can use Shell Service Tasks to perform malicious operations, including but not limited to file read, file write, and code execution...

Remote code execution

In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow entitlements can use Shell Service Tasks to perform malicious operations, including but not limited to file read, file write, and code execution...

CVE-2020-11977

In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow entitlements can use Shell Service Tasks to perform malicious operations, including but not limited to file read, file write, and code execution...