Syncope Security Vulnerabilities and Issues — Syncope CVE List

Lucene search

ApacheSyncope

4 matches found

CVE•added 2018/11/06 7:29 p.m.•59 views

CVE-2018-17184

A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector names, Report names, AnyTypeClass keys and Policy descriptions. When another user with enough administration entitlements edits one of the Entities above via Admin ...

5.4CVSS5.5AI score0.01003EPSS

CVE•added 2020/05/04 1:15 p.m.•59 views

CVE-2019-17557

It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the Enduser UI could execute javascript code from URL query string.

5.4CVSS5.5AI score0.01193EPSS

CVE•added 2024/07/22 10:15 a.m.•51 views

CVE-2024-38503

When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits.The same vulnerability was found in the Syncope Enduser, when editing “Personal Information” or “User Requests”. Users are recommended to upgrade to versi...

5.4CVSS6.3AI score0.00254EPSS

CVE•added 2014/07/11 2:55 p.m.•44 views

CVE-2014-3503

Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack.

5CVSS6.8AI score0.01942EPSS