Skip to content
OpenAdvisories

Package · Maven

org.apache.syncope:syncope-core

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.4
    CVE-2018-17184

    Improper Control of Interaction Frequency in Apache syncope-core

    A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector names, Report names, AnyTypeClass keys and Policy descriptions. When another user with enough administration entitlements ed…

    Apache Software Foundation Apache Syncope org.apache.syncope:syncope-core Maven
  • Medium 4.9
    CVE-2018-1322 Public exploit EPSS 20%

    Exposure of Sensitive Information to an Unauthorized Actor in Apache syncope-cope

    An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters.

    Apache Software Foundation Apache Syncope org.apache.syncope:syncope-core Maven