CVE-2014-0111

Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons JEXL expressions, "derived schema definition," "user / role templates," and "account links of resource mappings."

• CWE-94

• http://mail-archives.us.apache.org/mod_mbox/www-announce/201404.mbox/%3C534CE273.9020601%40apache.org%3E
• http://syncope.apache.org/security.htmlVendor Advisory
• http://www.securityfocus.com/archive/1/531841/100/0/threadedThird Party Advisory, VDB Entry
• http://mail-archives.us.apache.org/mod_mbox/www-announce/201404.mbox/%3C534CE273.9020601%40apache.org%3E
• http://syncope.apache.org/security.htmlVendor Advisory
• http://www.securityfocus.com/archive/1/531841/100/0/threadedThird Party Advisory, VDB Entry

Published

Apr 17, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-0105The auth_token middleware in the OpenStack Python client lib…
• CVE-2014-0106Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does no…
• CVE-2014-0107The TransformerFactory in Apache Xalan-Java before 2.7.2 doe…
• CVE-2014-0108Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2014-0109Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remo…
• CVE-2014-0110Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remo…
• CVE-2014-0112ParametersInterceptor in Apache Struts before 2.3.20 does no…
• CVE-2014-0113CookieInterceptor in Apache Struts before 2.3.20, when a wil…
• CVE-2014-0114Apache Commons BeanUtils, as distributed in lib/commons-bean…
• CVE-2014-0115Directory traversal vulnerability in the log viewer in Apach…
• CVE-2014-0116CookieInterceptor in Apache Struts 2.x before 2.3.20, when a…
• CVE-2014-0117The mod_proxy module in the Apache HTTP Server 2.4.x before …