Lucene search
GoogleOSV:CVE-2018-17184HistoryNov 06, 2018 - 7:29 p.m.
CVE-2018-17184
2018-11-0619:29:00
Google
osv.dev
5
0.001 Low
EPSS
Percentile
40.0%
A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector names, Report names, AnyTypeClass keys and Policy descriptions. When another user with enough administration entitlements edits one of the Entities above via Admin Console, the injected JavaScript code is executed.
| CPE | Name | Operator | Version |
|---|---|---|---|
| syncope | eq | syncope-2.1.0 | |
| syncope | eq | syncope-2.1.1 |
Related
nvd
nvd
CVE-2018-17184
2018-11-06 19:29:00
veracode
veracode
Cross-site Scripting (XSS)
2018-11-07 06:02:20
cvelist
cvelist
CVE-2018-17184
2018-11-06 00:00:00
github
github
Improper Control of Interaction Frequency in Apache syncope-core
2018-11-06 23:16:18
cve
cve
CVE-2018-17184
2018-11-06 19:29:00
osv
osv
Improper Control of Interaction Frequency in Apache syncope-core
2018-11-06 23:16:18
prion
prion
Hardcoded credentials
2018-11-06 19:29:00