GHSA-jqg8-m35q-jh7j
High · 7.5CVSS
7.5
EPSS
—
Published
Nov 24, 2025
CISA due date
—
The record
Apache Syncope's AES encryption stores hard-coded passwords in internal database
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.syncope:syncope-core | 0 | 3.0.15 |
| Maven | org.apache.syncope:syncope-core | 4.0.0 | 4.0.3 |
| maven | org.apache.syncope/syncope-core | 4.0.0 | 4.0.3 |
Related vulnerabilities
- CVE-2025-65998 Apache Syncope's AES encryption stores hard-coded passwords in internal database Same vulnerability
- CVE-2026-79735 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-321
- CVE-2026-78486 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-321
- CVE-2026-78481 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-321
- CVE-2026-53939 OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption… CWE-321
- CVE-2026-81821 The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards… CWE-321
- CVE-2026-80057 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-321
- CVE-2026-78487 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-321