GCVE - cpe:2.3:a:apache:syncope:1.1.5:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:syncope:1.1.5:*:*:*:*:*:*:*

part: a version: 1.1.5 update: *

Vendor	Apache (`b0303047-b7dd-5cf8-abcc-71b7d9d80b95`)
Product	Syncope (`8438ac48-fa54-5bcf-9ee5-40463e87f414`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:apache/syncope`	purl2cpe	2026-06-01 10:14:25.751073
`pkg:docker/apache/syncope`	purl2cpe	2026-06-01 10:14:25.751074
`pkg:github/apache/syncope`	purl2cpe	2026-06-01 10:14:25.751075
`pkg:maven/org.apache.syncope/syncope`	purl2cpe	2026-06-01 10:14:25.751077

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2018-1322`	vulnerable	2026-06-08 05:11:17.700919	Details available An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters. Published: 2018-03-20T17:00:00.000Z Updated: 2024-09-16T17:03:34.787Z Open on db.gcve.eu Reference links http://syncope.apache.org/security.html#CVE-2018-1322:_Information_disclosure_via_FIQL_and_ORDER_BY_sorting http://www.securityfocus.com/bid/103507 https://www.exploit-db.com/exploits/45400/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-1321`	vulnerable	2026-06-08 05:11:17.696307	Details available An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can use XSL Transformations (XSLT) to perform malicious operations, including but not limited to file read, file write, and code execution. Published: 2018-03-20T17:00:00.000Z Updated: 2024-09-16T18:03:42.299Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/103508 http://syncope.apache.org/security.html#CVE-2018-1321:_Remote_code_execution_by_administrators_with_report_and_template_entitlements https://www.exploit-db.com/exploits/45400/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-3503`	vulnerable	2026-06-08 05:05:33.061065	Details available Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack. Published: 2014-07-11T14:00:00.000Z Updated: 2024-08-06T10:43:06.363Z Open on db.gcve.eu Reference links http://www.securityfocus.com/archive/1/532669/100/0/threaded http://syncope.apache.org/security.html http://packetstormsecurity.com/files/127375/Apache-Syncope-Insecure-Password-Generation.html http://www.securityfocus.com/bid/68431	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.