Threats tagged 'ghsa-p5vm-7q6r-6j5w'

Apache Syncope versions from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2 contain an Insufficiently Protected Credentials vulnerability. Audit events sent to the configured store do not sufficiently mask sensitive values in their payloads, potentially exposing sensitive information to administrators. Upgrading to versions 4.0.8 or 4.1.3 resolves this issue.