Yll Berisha

Improper isolation or compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a JUEL expression is imported and started, the expression is executed directly on the server, with no sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0 through 4.1.3. Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue by rejecting BPMN definitions including expression attributes.

Authenticated attackers with the Instructor role can add answers to quiz questions owned by other instructors. This occurs due to a missing ownership and capability check on the question answer insert path, allowing attackers to supply arbitrary question identifiers and bypass instructor-boundary restrictions to persistently modify quiz content across courses they do not own.

Authenticated attackers with the Instructor role can perform a stored cross-site scripting attack by submitting unsanitized input into quiz question answer title fields. The issue occurs because the `answer title` parameter is rendered through an unescaped HTML sink, allowing arbitrary JavaScript to be stored and executed in the browsers of users who view the affected quiz question, including students, other instructors, and administrators.