SY
Product
Syncope
24
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 7Medium 8Low 0
Watch
Add Syncope to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-62183 | 9.8 | Jul 20 | Apache Syncope: User self-service privilege escalation Affected: 3.0.0 through 3.0.16; 4.0.0 before 4.0.7; 4.1.0 before 4.1.2 |
| CVE-2026-57308 | 9.8 | Jul 20 | Apache Syncope: SQL injection vulnerability in Audit Events search Affected: 3.0.0 through 3.0.16; 4.0.0 before 4.0.7; 4.1.0 before 4.1.2 |
| CVE-2026-53421 | 9.8 | Jul 20 | Apache Syncope: Remote Code Execution via Scripted Connector Affected: 3.0.0 through 3.0.16; 4.0.0 before 4.0.7; 4.1.0 before 4.1.2 |
| CVE-2026-53405 | 9.8 | Jul 20 | Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask Affected: 3.0.0 through 3.0.16; 4.0.0 before 4.0.7; 4.1.0 before 4.1.2 |
| CVE-2026-63071 | 9.8 | Jul 20 | Apache Syncope: RCE via Groovy Sandbox bypass Affected: 3.0.0 through 3.0.16; 4.0.0 before 4.0.7; 4.1.0 before 4.1.2 |
| CVE-2020-1961 | 9.8 | May 4 | Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to 2.1.6, enabling attackers to inject… Affected: 2.0.0 before 2.0.15; 2.1.0 before 2.1.6 |
| CVE-2020-1959 | 9.8 | May 4 | A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary Java EL expressions, leading to an unauthenticated Remote… Affected: 2.1.0 before 2.1.6 |
| CVE-2026-62418 | 8.1 | Jul 20 | Apache Syncope: Low-privileged authenticated SSRF in Connectors and Resources check Affected: 3.0.0 through 3.0.16; 4.0.0 before 4.0.7; 4.1.0 before 4.1.2 |
| CVE-2025-65998 | 7.5 | Nov 24 | Apache Syncope: Default AES key used for internal password encryption Affected: 2.1.0 through 2.1.14; 3.0.0 before 3.0.15; 4.0.0 before 4.0.3 |
| CVE-2026-42782 | 7.2 | May 25 | Apache Syncope: Post-auth RCE via Groovy static Affected: 3.0.0 through 3.0.16; 4.0.0 before 4.0.6; 4.1.0 |
| CVE-2025-57738 | 7.2 | Oct 20 | Apache Syncope: Remote Code Execution by delegated administrators Affected: 2.1.0 before 3.0.14; 4.0.0 before 4.0.2 |
| CVE-2020-11977 | 7.2 | Sep 15 | In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow entitlements can use Shell Service Tasks to perform… Affected: 2.1.0 before 2.1.7 |
| CVE-2018-17186 | 7.2 | Nov 6 | An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, file write, and code execution Affected: 2.0.0 through 2.0.11; 2.1.0 through 2.1.2 |
| CVE-2018-1321 | 7.2 | Mar 20 | An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also… Affected: 1.2.0 before 1.2.11; 2.0.0 before 2.0.8; 1.0.0; 1.0.4; 1.0.5; 1.0.6; +13 more |
| CVE-2026-23794 | 6.8 | Feb 3 | Apache Syncope: Reflected XSS on Enduser Login Affected: 3.0.0 before 3.0.16; 4.0.0 before 4.0.4 |
| CVE-2024-45031 | 6.1 | Oct 24 | Apache Syncope: Stored XSS in Console and Enduser Affected: 2.1.0 before 3.0.9 |
| CVE-2024-38503 | 5.4 | Jul 22 | When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits Affected: 2.1.0 through 2.1.14; 3.0.0 before 3.0.8 |
| CVE-2019-17557 | 5.4 | May 4 | It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters Affected: 2.0.0 before 2.0.15; 2.1.0 before 2.1.6 |
| CVE-2018-17184 | 5.4 | Nov 6 | A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector names, Report names, AnyTypeClass keys and… Affected: 2.0.0 before 2.0.11; 2.1.0 before 2.1.2 |
| CVE-2026-42797 | 4.9 | May 25 | Apache Syncope: JexlContextBuilder Information Disclosure Affected: 3.0.0 through 3.0.16; 4.0.0 before 4.0.6; 4.1.0 |
| CVE-2026-23795 | 4.9 | Feb 3 | Apache Syncope: Console XXE on Keymaster parameters Affected: 3.0.0 before 3.0.16; 4.0.0 before 4.0.4 |
| CVE-2018-1322 | 4.9 | Mar 20 | An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can… Affected: 1.2.0 before 1.2.11; 2.0.0 before 2.0.8; 1.0.0; 1.0.3; 1.0.4; 1.0.5; +13 more |
| CVE-2014-3503 | – | Jul 11 | Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack Affected: 1.1.0; 1.1.1; 1.1.2; 1.1.3; 1.1.4; 1.1.5; +2 more |
| CVE-2014-0111 | – | Apr 17 | Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons JEXL expressions,… Affected: 1.0.0 before 1.0.9; 1.1.0 before 1.1.7 |
Showing 24