SY
Product
Syncope
24
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 7Medium 8Low 0
Watch
Add Syncope to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-62183 | 9.8 | Jul 20 | Apache Syncope: User self-service privilege escalation Affected: 3.0.0 through 3.0.16; 4.0.0 before 4.0.7; 4.1.0 before 4.1.2 |
| CVE-2026-57308 | 9.8 | Jul 20 | Apache Syncope: SQL injection vulnerability in Audit Events search Affected: 3.0.0 through 3.0.16; 4.0.0 before 4.0.7; 4.1.0 before 4.1.2 |
| CVE-2026-53421 | 9.8 | Jul 20 | Apache Syncope: Remote Code Execution via Scripted Connector Affected: 3.0.0 through 3.0.16; 4.0.0 before 4.0.7; 4.1.0 before 4.1.2 |
| CVE-2026-53405 | 9.8 | Jul 20 | Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask Affected: 3.0.0 through 3.0.16; 4.0.0 before 4.0.7; 4.1.0 before 4.1.2 |
| CVE-2026-63071 | 9.8 | Jul 20 | Apache Syncope: RCE via Groovy Sandbox bypass Affected: 3.0.0 through 3.0.16; 4.0.0 before 4.0.7; 4.1.0 before 4.1.2 |
| CVE-2020-1961 | 9.8 | May 4 | Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to 2.1.6, enabling attackers to inject… Affected: 2.0.0 before 2.0.15; 2.1.0 before 2.1.6 |
| CVE-2020-1959 | 9.8 | May 4 | A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary Java EL expressions, leading to an unauthenticated Remote… Affected: 2.1.0 before 2.1.6 |
| CVE-2026-62418 | 8.1 | Jul 20 | Apache Syncope: Low-privileged authenticated SSRF in Connectors and Resources check Affected: 3.0.0 through 3.0.16; 4.0.0 before 4.0.7; 4.1.0 before 4.1.2 |
| CVE-2025-65998 | 7.5 | Nov 24 | Apache Syncope can be configured to store the user password values in the internal database with AES encryption, though this is not the default option Affected: 2.1.0 through 2.1.14; 3.0.0 before 3.0.15; 4.0.0 before 4.0.3 |
| CVE-2026-42782 | 7.2 | May 25 | Apache Syncope: Post-auth RCE via Groovy static Affected: 3.0.0 through 3.0.16; 4.0.0 before 4.0.6; 4.1.0 |
| CVE-2025-57738 | 7.2 | Oct 20 | Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide custom implementations of a few Java interfaces; such… Affected: 2.1.0 before 3.0.14; 4.0.0 before 4.0.2 |
| CVE-2020-11977 | 7.2 | Sep 15 | In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow entitlements can use Shell Service Tasks to perform… Affected: 2.1.0 before 2.1.7 |
| CVE-2018-17186 | 7.2 | Nov 6 | An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, file write, and code execution Affected: 2.0.0 through 2.0.11; 2.1.0 through 2.1.2 |
| CVE-2018-1321 | 7.2 | Mar 20 | An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also… Affected: 1.2.0 before 1.2.11; 2.0.0 before 2.0.8; 1.0.0; 1.0.4; 1.0.5; 1.0.6; +13 more |
| CVE-2026-23794 | 6.8 | Feb 3 | Reflected XSS in Apache Syncope's Enduser Login page Affected: 3.0.0 before 3.0.16; 4.0.0 before 4.0.4 |
| CVE-2024-45031 | 6.1 | Oct 24 | When editing objects in the Syncope Console, incomplete HTML tags could be used to bypass HTML sanitization Affected: 2.1.0 before 3.0.9 |
| CVE-2024-38503 | 5.4 | Jul 22 | When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits Affected: 2.1.0 through 2.1.14; 3.0.0 before 3.0.8 |
| CVE-2019-17557 | 5.4 | May 4 | It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters Affected: 2.0.0 before 2.0.15; 2.1.0 before 2.1.6 |
| CVE-2018-17184 | 5.4 | Nov 6 | A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector names, Report names, AnyTypeClass keys and… Affected: 2.0.0 before 2.0.11; 2.1.0 before 2.1.2 |
| CVE-2026-42797 | 4.9 | May 25 | Apache Syncope: JexlContextBuilder Information Disclosure Affected: 3.0.0 through 3.0.16; 4.0.0 before 4.0.6; 4.1.0 |
| CVE-2026-23795 | 4.9 | Feb 3 | Improper Restriction of XML External Entity Reference vulnerability in Apache Syncope Console Affected: 3.0.0 before 3.0.16; 4.0.0 before 4.0.4 |
| CVE-2018-1322 | 4.9 | Mar 20 | An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can… Affected: 1.2.0 before 1.2.11; 2.0.0 before 2.0.8; 1.0.0; 1.0.3; 1.0.4; 1.0.5; +13 more |
| CVE-2014-3503 | – | Jul 11 | Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack Affected: 1.1.0; 1.1.1; 1.1.2; 1.1.3; 1.1.4; 1.1.5; +2 more |
| CVE-2014-0111 | – | Apr 17 | Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons JEXL expressions,… Affected: 1.0.0 before 1.0.9; 1.1.0 before 1.1.7 |
Showing 24