You are viewing a plain text version of this content. The canonical link for it is here.
- [ANN] Apache Syncope 4.1.3 - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:12:46 UTC, 0 replies.
- [ANN] Apache Syncope 4.0.8 - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:14:19 UTC, 3 replies.
- CVE-2026-73191: Apache Syncope: CAS service URL injection via Forwarded HTTP headers - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:15:40 UTC, 0 replies.
- CVE-2026-73195: Apache Syncope: CSV export spreadsheet formula injection - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:17:26 UTC, 0 replies.
- CVE-2026-73236: Apache Syncope: Cross-Realm authorization bypass in delegated administration - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:18:24 UTC, 0 replies.
- CVE-2026-73370: Apache Syncope: Cross-Realm boundaries reconciliation bypass - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:19:36 UTC, 0 replies.
- CVE-2026-73178: Apache Syncope: JWT Access Token takeover - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:21:44 UTC, 0 replies.
- CVE-2026-73470: Apache Syncope: Delegating users can grant unowned Roles - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:24:01 UTC, 0 replies.
- CVE-2026-73579: Apache Syncope: Non-recursive Any search could skip Realms restrictions - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:24:47 UTC, 0 replies.
- CVE-2026-73668: Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:26:47 UTC, 0 replies.
- CVE-2026-75015: Apache Syncope: Nested secrets leak cleartext into audit records readable - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:27:52 UTC, 0 replies.
- CVE-2026-75030: Apache Syncope: Incomplete authorization checks for Group members deprovisioning - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:28:39 UTC, 0 replies.
- CVE-2026-77051: Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:29:30 UTC, 0 replies.
- CVE-2026-77147: Apache Syncope: Groovy Sandbox escape for empty CommandArgs - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:30:24 UTC, 0 replies.
- CVE-2026-77181: Apache Syncope: ClientApp update entitlement not effective - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:38:47 UTC, 0 replies.
- CVE-2026-77883: Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:41:05 UTC, 0 replies.
- CVE-2026-78318: Apache Syncope: Unauthenticated reflected XSS in Console and Enduser - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:42:00 UTC, 0 replies.
- CVE-2026-78330: Apache Syncope: Privilege escalation for admin user via JWT authentication - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:43:01 UTC, 0 replies.
- CVE-2026-78336: Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:44:22 UTC, 0 replies.
- CVE-2026-82232: Apache Syncope: SQL injection via sort parameter in Task search - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:45:57 UTC, 0 replies.
- CVE-2026-86460: Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:46:32 UTC, 0 replies.
- CVE-2026-87779: Apache Syncope: AES Secret Key disclosure via log output - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:47:17 UTC, 0 replies.
- CVE-2026-87785: Apache Syncope: JWT subject spoofing - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:47:50 UTC, 0 replies.
- CVE-2026-87802: Apache Syncope: SRA OAuth2 JWT signature verification bypass - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:49:11 UTC, 0 replies.