SY
Product
Syncope
24
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 7Medium 8Low 0
Watch
Add Syncope to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-23794 | 6.8 | Feb 3 | Apache Syncope: Reflected XSS on Enduser Login Affected: 3.0.0 before 3.0.16; 4.0.0 before 4.0.4 |
| CVE-2024-45031 | 6.1 | Oct 24 | When editing objects in the Syncope Console, incomplete HTML tags could be used to bypass HTML sanitization Affected: 2.1.0 before 3.0.9 |
| CVE-2024-38503 | 5.4 | Jul 22 | When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits Affected: 2.1.0 through 2.1.14; 3.0.0 before 3.0.8 |
| CVE-2019-17557 | 5.4 | May 4 | It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters Affected: 2.0.0 before 2.0.15; 2.1.0 before 2.1.6 |
| CVE-2018-17184 | 5.4 | Nov 6 | A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector names, Report names, AnyTypeClass keys and… Affected: 2.0.0 before 2.0.11; 2.1.0 before 2.1.2 |
| CVE-2026-42797 | 4.9 | May 25 | Apache Syncope: JexlContextBuilder Information Disclosure Affected: 3.0.0 through 3.0.16; 4.0.0 before 4.0.6; 4.1.0 |
| CVE-2026-23795 | 4.9 | Feb 3 | Apache Syncope: Console XXE on Keymaster parameters Affected: 3.0.0 before 3.0.16; 4.0.0 before 4.0.4 |
| CVE-2018-1322 | 4.9 | Mar 20 | An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can… Affected: 1.2.0 before 1.2.11; 2.0.0 before 2.0.8; 1.0.0; 1.0.3; 1.0.4; 1.0.5; +13 more |
Showing 8