Skip to content

Vendor

org.apache.syncope.client vulnerabilities

2 published CVES affecting org.apache.syncope.client, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
0
Medium
2
Low
0
Unscored
0
CISA KEV
0
Atom feed of org.apache.syncope.client alerts

Products

Latest org.apache.syncope.client CVEs

Newest publication first

  1. CVE-2024-45031 Apache Syncope: Stored XSS in Console and Enduser

    Published
    MediumCVSS 6.1 EPSS 0.71%

    When editing objects in the Syncope Console, incomplete HTML tags could be used to bypass HTML sanitization. This made it possible to inject stored XSS payloads which would trigger for other users during ordinary usage of the application. XSS payloads could also be injected in Sy...

  2. CVE-2019-17557 Cross-site scripting in Apache Syncome EndUser

    Published
    MediumCVSS 5.4 EPSS 1.2%

    It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the Enduser UI could execute javascript code from URL query string.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.