org.apache.syncope.client.am:syncope-client-am-console (>=3.0.0-m0, <=3.0.6), org.apache.syncope.client.idm:syncope-client-idm-console (>=3.0.0-m0, <=3.0.6) +14 more potentially affected by CVE-2024-27439 via org.apache.wicket:wicket (>=9.11.0, <=9.16.0)

org.apache.wicket:wicket MAVEN version =9.11.0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.0-m0, =3.0.6 - org.apache.syncope.e...

CVE-2021-43974

An issue was discovered in SysAid ITIL 20.4.74 b10. The /enduserreg endpoint is used to register end users anonymously, but does not respect the server-side setting that determines if anonymous users are allowed to register new accounts. Configuring the server-side setting to disable anonymous us...

GHSA-6QJ8-C27W-RP33 Cross-site scripting in Apache Syncome EndUser

It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the Enduser UI could execute javascript code from URL query string...

Cross-site scripting in Apache Syncome EndUser

It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the Enduser UI could execute javascript code from URL query string...

org.apache.syncope.ext.oidcclient:syncope-ext-oidcclient-client-enduser (>=2.0.9, <=2.0.14), org.apache.syncope.ext.saml2sp:syncope-ext-saml2sp-client-enduser (>=2.0.3, <=2.0.14) potentially affected by CVE-2019-17557 via org.apache.syncope.client:syncope-client-enduser (>=2.0.3, <=2.0.14)

org.apache.syncope.client:syncope-client-enduser MAVEN version =2.0.3, =2.0.9, =2.0.3, =2.0.14 Source cves: CVE-2019-17557 Source advisory: OSV:GHSA-6QJ8-C27W-RP33...

org.apache.syncope.ext.oidcclient:syncope-ext-oidcclient-client-enduser (>=2.0.9, <=2.0.14), org.apache.syncope.ext.saml2sp:syncope-ext-saml2sp-client-enduser (>=2.0.3, <=2.0.14) potentially affected by CVE-2019-17557 via org.apache.syncope.client:syncope-client-enduser (>=2.0.3, <=2.0.14)

org.apache.syncope.client:syncope-client-enduser MAVEN version =2.0.3, =2.0.9, =2.0.3, =2.0.14 Source cves: CVE-2019-17557 Source advisory: GHSA-6QJ8-C27W-RP33...

org.apache.syncope.ext.flowable:syncope-ext-flowable-client-enduser (>=2.1.3, <=2.1.5), org.apache.syncope.ext.oidcclient:syncope-ext-oidcclient-client-enduser (>=2.1.0, <=2.1.5) +1 more potentially affected by CVE-2019-17557 via org.apache.syncope.client:syncope-client-enduser (>=2.1.0, <=2.1.5)

org.apache.syncope.client:syncope-client-enduser MAVEN version =2.1.0, =2.1.3, =2.1.0, =2.1.0, =2.1.5 Source cves: CVE-2019-17557 Source advisory: OSV:GHSA-6QJ8-C27W-RP33...

org.apache.syncope.ext.flowable:syncope-ext-flowable-client-enduser (>=2.1.3, <=2.1.5), org.apache.syncope.ext.oidcclient:syncope-ext-oidcclient-client-enduser (>=2.1.0, <=2.1.5) +1 more potentially affected by CVE-2019-17557 via org.apache.syncope.client:syncope-client-enduser (>=2.1.0, <=2.1.5)

org.apache.syncope.client:syncope-client-enduser MAVEN version =2.1.0, =2.1.3, =2.1.0, =2.1.0, =2.1.5 Source cves: CVE-2019-17557 Source advisory: GHSA-6QJ8-C27W-RP33...

CVE-2020-29496

Dell Wyse Management Suite versions prior to 3.1 contain a stored cross-site scripting vulnerability. A remote authenticated malicious user with high privileges could exploit this vulnerability to store malicious HTML or JavaScript code while creating the Enduser. When victim users access the...

CVE-2020-29496: Improper Neutralization of Input During Web Page Generation

Dell Wyse Management Suite versions prior to 3.1 contain a stored cross-site scripting vulnerability. A remote authenticated malicious user with high privileges could exploit this vulnerability to store malicious HTML or JavaScript code while creating the Enduser. When victim users access the...

PT-2021-11678

Name of the Vulnerable Software and Affected Versions: Dell Wyse Management Suite versions prior to 3.1 Description: The issue allows a remote authenticated malicious user with high privileges to store malicious HTML or JavaScript code while creating the Enduser. When victim users access the...

Apache Syncope Cross-Site Scripting Vulnerability (CNVD-2020-31755)

Apache Syncope is the United States Apache Apache Foundation's set of open source digital identity management system for use in enterprise environments. The system supports identity management, role configuration and more. A cross-site scripting vulnerability in the EndUser UI login page in Apach...

CVE-2019-17557

It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the Enduser UI could execute javascript code from URL query string...

CVE-2019-17557

It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the Enduser UI could execute javascript code from URL query string...

Design/Logic Flaw

It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the Enduser UI could execute javascript code from URL query string...

CVE-2019-17557

It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the Enduser UI could execute javascript code from URL query string...

CVE-2019-17557

It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the Enduser UI could execute javascript code from URL query string...

org.apache.syncope.ext.oidcclient:syncope-ext-oidcclient-client-enduser (>=2.0.9, <=2.0.14), org.apache.syncope.ext.saml2sp:syncope-ext-saml2sp-client-enduser (>=2.0.3, <=2.0.14) potentially affected by CVE-2019-17557 via org.apache.syncope.client:syncope-client-enduser (>=2.0.3, <=2.0.14)

org.apache.syncope.client:syncope-client-enduser MAVEN version =2.0.3, =2.0.9, =2.0.3, =2.0.14 Source cves: CVE-2019-17557 Source advisory: MEND:CVE-2019-17557...

org.apache.syncope.ext.flowable:syncope-ext-flowable-client-enduser (>=2.1.3, <=2.1.5), org.apache.syncope.ext.oidcclient:syncope-ext-oidcclient-client-enduser (>=2.1.0, <=2.1.5) +1 more potentially affected by CVE-2019-17557 via org.apache.syncope.client:syncope-client-enduser (>=2.1.0, <=2.1.5)

org.apache.syncope.client:syncope-client-enduser MAVEN version =2.1.0, =2.1.3, =2.1.0, =2.1.0, =2.1.5 Source cves: CVE-2019-17557 Source advisory: MEND:CVE-2019-17557...

CVE-2019-17557

CVE-2019-17557 describes a reflected XSS in the Apache Syncope EndUser UI login page, before versions 2.0.15 and 2.1.6, where the UI reflects the successMessage parameter in the URL query string, allowing an attacker to execute arbitrary JavaScript in a user’s browser. The issue is caused by insu...