Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.syncope:syncope-core

7 known vulnerabilities (1 high), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
7 · 1 high
Dependents
0
Registry
Maven Central

Advisories 7

  • Apache Syncope: Default AES key used for internal password encryption

    Affected: from 4.0.0, fixed in 4.0.3; fixed in 3.0.15.

  • Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior…

    Affected: from 2.0.0, fixed in 2.0.15; from 2.1.0, fixed in 2.1.6.

  • A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary Java EL…

    Affected: fixed in 2.1.6.

  • An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file…

    Affected: fixed in 2.0.11; from 2.1.0, fixed in 2.1.2.

  • A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector…

    Affected: fixed in 2.0.11; from 2.1.0, fixed in 2.1.2.

  • An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x…

    Affected: fixed in 1.2.11; from 2.0.0, fixed in 2.0.8.

  • An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases…

    Affected: fixed in 1.2.11; from 2.0.0, fixed in 2.0.8.