Injection in Apache Syncope

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2020-1961 · ADVISORY
• syncope.apache.org/security · WEB

org.apache.syncope:syncope-core のその他の脆弱性

• CVE-2025-65998高 7.5Apache Syncope can be configured to store the user password values in the internal database with AES encryption, though this is not the defa…
• CVE-2020-1959緊急 9.8A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary Java EL expressions,…
• CVE-2018-17186高 7.2An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, …
• CVE-2018-17184中 5.4A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector names…
• CVE-2018-1322中 4.9An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and…