org.apache.syncope:syncope-core-upgrader (1.2.1) potentially affected by CVE-2018-17184 via org.apache.syncope:syncope-core (1.2.1)

org.apache.syncope:syncope-core MAVEN version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-core-upgrader 1.2.1 Source cves: CVE-2018-17184 Source advisory:...

org.apache.syncope:syncope-standalone (1.1.7) potentially affected by CVE-2018-17184 via org.apache.syncope:syncope-core (1.1.7)

org.apache.syncope:syncope-core MAVEN version 1.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-standalone 1.1.7 Source cves: CVE-2018-17184 Source advisory:...

GHSA-9H9C-F287-C6VP Improper Control of Interaction Frequency in Apache syncope-core

A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector names, Report names, AnyTypeClass keys and Policy descriptions. When another user with enough administration entitlements edits one of the Entities above via Admi...

org.apache.syncope:syncope-standalone (1.1.2) potentially affected by CVE-2018-17186 via org.apache.syncope:syncope-core (1.1.2)

org.apache.syncope:syncope-core MAVEN version 1.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-standalone 1.1.2 Source cves: CVE-2018-17186 Source advisory:...

GHSA-QFJV-998W-Q48F Improper Restriction of XML External Entity Reference in org.apache.syncope:syncope-core

An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, file write, and code execution...

Improper Restriction of XML External Entity Reference in org.apache.syncope:syncope-core

An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, file write, and code execution...

org.apache.syncope:syncope-standalone (1.1.6) potentially affected by CVE-2018-17186 via org.apache.syncope:syncope-core (1.1.6)

org.apache.syncope:syncope-core MAVEN version 1.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-standalone 1.1.6 Source cves: CVE-2018-17186 Source advisory:...

org.apache.syncope:syncope-core-upgrader (1.2.6) potentially affected by CVE-2018-17186 via org.apache.syncope:syncope-core (1.2.6)

org.apache.syncope:syncope-core MAVEN version 1.2.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-core-upgrader 1.2.6 Source cves: CVE-2018-17186 Source advisory:...

org.apache.syncope:syncope-core-upgrader (1.2.10) potentially affected by CVE-2018-17186 via org.apache.syncope:syncope-core (1.2.10)

org.apache.syncope:syncope-core MAVEN version 1.2.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-core-upgrader 1.2.10 Source cves: CVE-2018-17186 Source advisory:...

org.apache.syncope:syncope-standalone (1.1.4) potentially affected by CVE-2018-17186 via org.apache.syncope:syncope-core (1.1.4)

org.apache.syncope:syncope-core MAVEN version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.syncope:syncope-core and may be impacted: - org.apache.syncope:syncope-standalone 1.1.4 Source cves: CVE-2018-17186 Source advisory:...

Apache Syncope 2.0.7 Remote Code Execution

Exploit Title: Apache Syncope 2.0.7 - Remote Code Execution Date: 2018-09-12 Exploit Author: Che-Chun Kuo Vendor Homepage: https://syncope.apache.org/ Software Link: http://archive.apache.org/dist/syncope/ Version: 2.0.7 Tested on: Windows Advisory: https://syncope.apache.org/security CVE:...

Apache Syncope Remote Code Execution Vulnerability (CNVD-2018-18784)

Apache Syncope is the United States Apache Apache Software Foundation's set of open source digital identity management system for use in enterprise environments. The system supports identity management, role configuration and more. Apache Syncope uses XSLT to export report data to various formats...

Apache Syncope Information Disclosure Vulnerability (CNVD-2018-18783)

Apache Syncope is the United States Apache Apache Software Foundation's set of open source digital identity management system for use in enterprise environments. The system supports identity management, role configuration and more. Apache Syncope suffers from an information disclosure vulnerabili...

Apache Syncope 2.0.7 - Remote Code Execution

Exploit Title: Apache Syncope 2.0.7 - Remote Code Execution Date: 2018-09-12 Exploit Author: Che-Chun Kuo Vendor Homepage: https://syncope.apache.org/ Software Link: http://archive.apache.org/dist/syncope/ Version: 2.0.7 Tested on: Windows Advisory: https://syncope.apache.org/security CVE:...

Apache Syncope 2.0.7 - Remote Code Execution

Apache Syncope 2.0.7 - Remote Code Execution Exploit Title: Apache Syncope 2.0.7 - Remote Code Execution Date: 2018-09-12 Exploit Author: Che-Chun Kuo Vendor Homepage: https://syncope.apache.org/ Software Link: http://archive.apache.org/dist/syncope/ Version: 2.0.7 Tested on: Windows Advisory:...

Apache Syncope Information Disclosure Vulnerability

Apache Syncope is the United States Apache Apache Software Foundation's set of open source digital identity management system for use in enterprise environments. The system supports identity management, role configuration and more. A security vulnerability exists in Apache Syncope versions 1.2.x...

Apache Syncope Remote Code Execution Vulnerability

Apache Syncope is the United States Apache Apache Software Foundation's set of open source digital identity management system for use in enterprise environments. The system supports identity management, role configuration and more. A security vulnerability exists in Apache Syncope versions 1.2.x...

Remote code execution

An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can use XSL Transformations XSLT to perform malicious operations, including but not limited to file read, file...

CVE-2018-1321

An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can use XSL Transformations XSLT to perform malicious operations, including but not limited to file read, file...

Design/Logic Flaw

An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters...