CVE-2024-38503

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. The same vulnerability was found in the Syncope Enduser, when editing “Personal Information” or “User Requests”.

Users are recommended to upgrade to version 3.0.8, which fixes this issue.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jul 22, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-385045.3In JetBrains YouTrack before 2024.2.34646 the Guest User Account was enabled for attaching files to articles CVE-2024-385057.5In JetBrains YouTrack before 2024.2.34646 user access token was sent to the third-party site CVE-2024-385068.1In JetBrains YouTrack before 2024.2.34646 user without appropriate permissions could enable the auto-attach option for workflows CVE-2024-385075.4In JetBrains Hub before 2024.2.34646 stored XSS via project description was possible CVE-2024-385087.2A privilege escalation vulnerability was discovered in the web interface or SSH captive command shell interface of XCC that could allow an a CVE-2024-385097.2A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to execute ar CVE-2024-38515.4A stored Cross-Site Scripting (XSS) vulnerability exists in the 'imartinez/privategpt' repository due to improper validation of file uploads CVE-2024-385107.2A privilege escalation vulnerability was discovered in the SSH captive command shell interface that could allow an authenticated XCC user wi CVE-2024-385117.2A privilege escalation vulnerability was discovered in an upload processing functionality of XCC that could allow an authenticated XCC user CVE-2024-385127.2A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to perform co CVE-2024-385139.8Fiber is an Express-inspired web framework written in Go A vulnerability present in versions prior to 2.52.5 is a session middleware issue i CVE-2024-385147.4NextChat is a cross-platform ChatGPT/Gemini UI. There is a Server-Side Request Forgery (SSRF) vulnerability due to a lack of validation of t