org.apache.syncope:syncope-core@1.2.2 vulnerabilities
latest version
3.0.10
latest non vulnerable version
first published
12 years ago
latest version published
21 days ago
licenses detected
- [1.0.0-RC1-incubating,)
package manager
Direct Vulnerabilities
Known vulnerabilities in the org.apache.syncope:syncope-core package. This does not include vulnerabilities belonging to this package’s dependencies.
How to fix?
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free| Vulnerability | Vulnerable Version |
|---|---|
org.apache.syncope:syncope is an Open Source system for managing digital identities in enterprise environments. Affected versions of this package are vulnerable to Cross-site Scripting (XSS) attacks. A malicious user with an administration entitlements could inject How to fix Cross-site Scripting (XSS)? Upgrade | [,2.0.11)[2.1.0,2.1.2) |
org.apache.syncope:syncope-core is an Open Source system for managing digital identities in enterprise environments, implemented in Java EE technology and released under Apache 2.0 license. Affected versions of this package are vulnerable to Information Exposure. An administrator with user search entitlements can recover sensitive security values using the How to fix Information Exposure? Upgrade | [1.2.0,1.2.11)[2.0.0,2.0.8) |
org.apache.syncope:syncope-core is an Open Source system for managing digital identities in enterprise environments, implemented in Java EE technology and released under Apache 2.0 license. Affected versions of this package are vulnerable to Arbitrary Code Execution. An administrator with report and template entitlements can use XSL Transformations (XSLT) to perform malicious operations, including but not limited to file read, file write, and code execution. How to fix Arbitrary Code Execution? Upgrade | [1.2.0,1.2.11)[2.0.0,2.0.8) |