CVE-2018-1322

An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters...

CVE-2018-1322

An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters...

CVE-2018-1321

An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can use XSL Transformations XSLT to perform malicious operations, including but not limited to file read, file...

CVE-2018-1321

An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can use XSL Transformations XSLT to perform malicious operations, including but not limited to file read, file...

CVE-2018-1321

Apache Syncope vulnerability CVE-2018-1321: An administrator with report and template entitlements can abuse XSLT to perform malicious operations (read/write files, execute code) in affected releases of Apache Syncope 1.2.x before 1.2.11 and 2.0.x before 2.0.8 (plus some unsupported 1.0/1.1 branc...

CVE-2018-1321

An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can use XSL Transformations XSLT to perform malicious operations, including but not limited to file read, file...

CVE-2018-1322

An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters...

CVE-2018-1322

CVE-2018-1322 affects Apache Syncope: 1.2.x before 1.2.11, 2.0.x before 2.0.8, and some unsupported releases (1.0.x, 1.1.x). The vulnerability allows an administrator with user-search entitlements to recover sensitive security values by manipulating the fiql and orderby parameters. The provided d...

CVE-2018-1322

An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters...

org.apache.syncope:syncope-core-upgrader (>=1.2.0-m1, <=1.2.10), org.apache.syncope:syncope-standalone (>=1.1.0, <=1.1.8) potentially affected by CVE-2018-1321 via org.apache.syncope:syncope-core (>=1.1.0, <=1.2.10)

org.apache.syncope:syncope-core MAVEN version =1.1.0, =1.2.0-m1, =1.1.0, =1.1.8 Source cves: CVE-2018-1321 Source advisory: MEND:CVE-2018-1321...

org.apache.syncope:syncope-core-upgrader (>=1.2.0-m1, <=1.2.10), org.apache.syncope:syncope-standalone (>=1.1.0, <=1.1.8) potentially affected by CVE-2018-1322 via org.apache.syncope:syncope-core (>=1.1.0, <=1.2.10)

org.apache.syncope:syncope-core MAVEN version =1.1.0, =1.2.0-m1, =1.1.0, =1.1.8 Source cves: CVE-2018-1322 Source advisory: MEND:CVE-2018-1322...

Information Disclosure

apache-syncope is vulnerable to information disclosure. A malicious administrator user with search permissions can gain access to sensitive information through queries with the ORDERBY argument...

Remote Code Execution (RCE)

apache-syncope is vulnerable to remote code execution RCE attacks. A malicious administrator user can with report and template permissions can use XSL Transformations XSLT to inject and execute arbitrary code...

CVE-2018-1321: Improper Input Validation

An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can use XSL Transformations XSLT to perform malicious operations, including but not limited to file read, file...

PT-2018-3348

Name of the Vulnerable Software and Affected Versions: Apache Syncope versions 1.0.x through 1.2.10 Apache Syncope versions 2.0.x through 2.0.7 Apache Syncope version 1.1.x Description: The issue is related to insufficient input validation in the implementation of XSLT technology in Apache Syncop...

PT-2018-11701

Name of the Vulnerable Software and Affected Versions Apache Syncope versions 1.0.x through 1.2.10 Apache Syncope versions 2.0.x through 2.0.7 Description An administrator with user search entitlements can recover sensitive security values using the fiql and orderby parameters. Recommendations Fo...

CVE-2018-1322: Exposure of Sensitive Information to an Unauthorized Actor

An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters...

[SECURITY] CVE-2014-3503 Apache Syncope

cve-2014-3503.txt.asc -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2014-3503: Insecure Random implementations used to generate passwords in Apache Syncope Severity: Major Vendor: The Apache Software Foundation Versions Affected: This vulnerability affects all versions of Apache Syncope 1.1.x...

CVE-2014-3503

Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack...

Default credentials

Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack...