Syncope (Apache) - vulnerabilities (CVEs)

24 CVEs, 0 in the last 30 days, 107 known versions, newest CVE from 2026-07-20. Vendor: Apache.

CVEs of Syncope

CVE-2026-62418 - CVSS 8.1 (high), 2026-07-20: Low-privileged authenticated Server-Side Request Forgery (SSRF) vulnerability in Apache Syncope via Connectors and Resources check. This issue affects Apache…
CVE-2026-62183 - CVSS 9.8 (critical), 2026-07-20: Improper Privilege Management vulnerability in Apache Syncope. When: * the all-Java user workflow adapter is configured, or * the Flowable user workflow…
CVE-2026-57308 - CVSS 9.8 (critical), 2026-07-20: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator with adequate…
CVE-2026-53421 - CVSS 9.8 (critical), 2026-07-20: Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve remote code execution…
CVE-2026-53405 - CVSS 9.8 (critical), 2026-07-20: Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process…
CVE-2026-63071 - CVSS 9.8 (critical), 2026-07-20: Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a…
CVE-2026-42797 - CVSS 4.9 (medium), 2026-05-25: Exposure of Sensitive Information Through Data Queries vulnerability in Apache Syncope. An administrator with adequate entitlements for Derived Schemas can…
CVE-2026-42782 - CVSS 7.2 (high), 2026-05-25: Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a…
CVE-2026-23795 - CVSS 4.9 (medium), 2026-02-03: Improper Restriction of XML External Entity Reference vulnerability in Apache Syncope Console. An administrator with adequate entitlements to create or edit…
CVE-2026-23794 - CVSS 6.8 (medium), 2026-02-03: Reflected XSS in Apache Syncope's Enduser Login page. An attacker that tricks a legitimate user into clicking a malicious link and logging in to Syncope…
CVE-2025-65998 - CVSS 7.5 (high), 2025-11-24: Apache Syncope can be configured to store the user password values in the internal database with AES encryption, though this is not the default option. When…
CVE-2025-57738 - CVSS 7.2 (high), 2025-10-20: Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide custom implementations of a few Java…
CVE-2024-45031 - CVSS 6.1 (medium), 2024-10-24: When editing objects in the Syncope Console, incomplete HTML tags could be used to bypass HTML sanitization. This made it possible to inject stored XSS…
CVE-2024-38503 - CVSS 5.4 (medium), 2024-07-22: When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. The same…
CVE-2020-11977 - CVSS 7.2 (high), 2020-09-15: In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow entitlements can use Shell Service…
CVE-2020-1961 - CVSS 9.8 (critical), 2020-05-04: Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to 2.1.6, enabling…
CVE-2020-1959 - CVSS 9.8 (critical), 2020-05-04: A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary Java EL expressions, leading to an…
CVE-2019-17557 - CVSS 5.4 (medium), 2020-05-04: It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the…
CVE-2018-17186 - CVSS 7.2 (high), 2018-11-06: An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, file write, and…
CVE-2018-17184 - CVSS 5.4 (medium), 2018-11-06: A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector names, Report names,…
CVE-2018-1322 - CVSS 4.9 (medium), 2018-03-20: An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may…
CVE-2018-1321 - CVSS 7.2 (high), 2018-03-20: An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x…
CVE-2014-3503 - CVSS 5 (medium), 2014-07-11: Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute…
CVE-2014-0111 - CVSS 6.5 (medium), 2014-04-17: Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons…