Apache Syncope Input Validation Error Vulnerability

Apache Syncope is the United States Apache Apache Foundation's set of open source digital identity management system for use in enterprise environments. The system supports identity management, role configuration and more. Apache Syncope suffers from an input validation error vulnerability that c...

HTML Injection

Apache Syncope is vulnerable to HTML injection. The vulnerability is due to improper input validation, allowing HTML tags to be added to any text field, leading to potential injections. Attackers can use this to inject malicious HTML or scripts, which could compromise user data and application...

org.apache.syncope.client.am:syncope-client-am-console (>=3.0.0 <=3.0.16), org.apache.syncope.client.idm:syncope-client-idm-console (>=3.0.0 <=3.0.16) +5 more potentially affected by CVE-2024-38503 via org.apache.syncope.client.idrepo:syncope-client-idrepo-console (>=3.0.0-M0 <=3.0.7)

org.apache.syncope.client.idrepo:syncope-client-idrepo-console MAVEN version =3.0.0-M0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.16 Source cves: CVE-2024-38503 Source advisory: OSV:GHSA-8PXV-X6JQ-5VW9...

org.apache.syncope.client.am:syncope-client-am-console (>=3.0.0 <=3.0.16), org.apache.syncope.client.am:syncope-client-am-enduser (>=3.0.12 <=3.0.16) +14 more potentially affected by CVE-2024-38503 via org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui (>=3.0.0-M0 <=3.0.7)

org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui MAVEN version =3.0.0-M0, =3.0.0, =3.0.12, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.16 - org.apache.syncope.ext.saml2sp4ui:syncope-ext-saml2sp4ui-client-consol...

GHSA-8PXV-X6JQ-5VW9 Apache Syncope Improper Input Validation vulnerability

When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. The same vulnerability was found in the Syncope Enduser, when editing "Personal Information" or "User Requests". Users are recommended to upgrade to...

Apache Syncope Improper Input Validation vulnerability

When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. The same vulnerability was found in the Syncope Enduser, when editing "Personal Information" or "User Requests". Users are recommended to upgrade to...

CVE-2024-38503

When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. The same vulnerability was found in the Syncope Enduser, when editing “Personal Information” or “User Requests”. Users are recommended to upgrade to...

CVE-2024-38503 Apache Syncope: HTML tags can be injected into Console or Enduser text fields

When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. The same vulnerability was found in the Syncope Enduser, when editing “Personal Information” or “User Requests”. Users are recommended to upgrade to...

CVE-2024-38503

Apache Syncope HTML-injection vulnerability (CVE-2024-38503) affects the Syncope Console and Enduser UI, where HTML tags can be injected into text fields during edits of users, groups, or other objects, potentially enabling exploits. The issue is documented across multiple sources (NVD, CNVD, Ver...

CVE-2024-38503 Apache Syncope: HTML tags can be injected into Console or Enduser text fields

When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. The same vulnerability was found in the Syncope Enduser, when editing “Personal Information” or “User Requests”. Users are recommended to upgrade to...

CVE-2024-38503 Apache Syncope: HTML tags can be injected into Console or Enduser text fields

When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. The same vulnerability was found in the Syncope Enduser, when editing “Personal Information” or “User Requests”. Users are recommended to upgrade to...

PT-2024-28040 · Unknown +1 · Syncope Console +2

Name of the Vulnerable Software and Affected Versions: Syncope versions prior to 3.0.8 Description: The issue allows HTML tags to be added to any text field when editing a user, group, or object in the Syncope Console, potentially leading to exploits. The same vulnerability is found in the Syncop...

Apache Syncope 输入验证错误漏洞

Apache Syncope is the United States Apache Apache Foundation's set of open source digital identity management system for use in enterprise environments. The system supports identity management, role configuration and more. Apache Syncope suffers from an input validation error vulnerability that c...

K49033153: Apache Syncope vulnerabilities CVE-2018-1321 and CVE-2018-1322

Security Advisory Description CVE-2018-1321 An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can use XSL Transformations XSLT to perform malicious operations,...

GHSA-4C72-MRHF-23CG Apache Syncope uses a weak PNRG

Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack...

Apache Syncope uses a weak PNRG

Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack...

GHSA-R2XF-W5PJ-9PW8 Apache Syncope JEXL Code Injection

Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons JEXL expressions, "derived schema definition," "user / role templates," and "account links of resource mappings."...

Apache Syncope JEXL Code Injection

Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons JEXL expressions, "derived schema definition," "user / role templates," and "account links of resource mappings."...

org.apache.syncope.ext.flowable:syncope-ext-flowable-client-enduser (>=2.1.3 <=2.1.14), org.apache.syncope.ext.oidcclient:syncope-ext-oidcclient-client-enduser (>=2.1.0 <=2.1.14) +1 more potentially affected by CVE-2019-17557 via org.apache.syncope.client:syncope-client-enduser (>=2.1.0 <=2.1.5)

org.apache.syncope.client:syncope-client-enduser MAVEN version =2.1.0, =2.1.3, =2.1.0, =2.1.0, =2.1.14 Source cves: CVE-2019-17557 Source advisory: OSV:GHSA-6QJ8-C27W-RP33...

org.apache.syncope.ext.oidcclient:syncope-ext-oidcclient-client-enduser (>=2.0.10 <=2.0.14), org.apache.syncope.ext.saml2sp:syncope-ext-saml2sp-client-enduser (>=2.0.10 <=2.0.14) potentially affected by CVE-2019-17557 via org.apache.syncope.client:syncope-client-enduser (>=2.0.10 <=2.0.14)

org.apache.syncope.client:syncope-client-enduser MAVEN version =2.0.10, =2.0.10, =2.0.10, =2.0.14 Source cves: CVE-2019-17557 Source advisory: OSV:GHSA-6QJ8-C27W-RP33...