Known vulnerabilities in Apache Syncope

Software CPE: cpe:2.3:a:apache_foundation:syncope:*:*:*:*:*:*:*:*
Total vulnerabilities: 12
Public exploits: 2
Known exploited (KEV): 0
Highest CVSSv4 Score: 8.7

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Apache Syncope Apache Syncope is affected by 12 known vulnerabilities: 2 high, 1 medium, 9 low Critical High Medium Low

Vulnerabilities (12)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU118828 - Improper Control of Generation of Code ('Code Injection')
CVE-2025-57738
CWE-94 Low
No
No
3.0.14, 4.0.2 28.11.2025 SB2025112814
#VU118827 - Use of Hard-coded Cryptographic Key
CVE-2025-65998
CWE-321 Low
No
No
3.0.15, 4.0.3 28.11.2025 SB2025112813
#VU99349 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-45031
CWE-79 Low
No
No
3.0.9 25.10.2024 SB2024102534
#VU94767 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2024-38503
CWE-79 Low
No
No
3.0.8 26.07.2024 SB2024072651
#VU46699 - Improper Control of Generation of Code ('Code Injection')
CVE-2020-1961
CWE-94 High
No
No
2.1.6 14.09.2020 SB2020050445
#VU46698 - Improper Control of Generation of Code ('Code Injection')
CVE-2020-1959
CWE-94 High
No
No
2.1.6 14.09.2020 SB2020050445
#VU46697 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2019-17557
CWE-79 Low
No
No
2.1.6 14.09.2020 SB2020050445
#VU46695 - Permissions, Privileges, and Access Controls
CVE-2020-11977
CWE-264 Low
No
No
2.1.7 14.09.2020 SB2020091424
#VU15654 - XML Injection
CVE-2018-1321
CWE-91 Low
Available
No
1.2.11, 2.0.8 31.10.2018 SB2018103108
#VU15645 - Exposure of sensitive information to an unauthorized actor
CVE-2018-1322
CWE-200 Low
Available
No
1.2.11, 2.0.8 31.10.2018 SB2018103108
#VU41482 - Cryptographic Issues
CVE-2014-3503
CWE-310 Medium
No
No
- 11.07.2014 SB2014071101
#VU41792 - Improper Control of Generation of Code ('Code Injection')
CVE-2014-0111
CWE-94 Low
No
No
1.1.7 17.04.2014 SB2014041711