n0mi1k

Apache Syncope: JWT Access Token takeover

Apache Syncope: Delegating users can grant unowned Roles

Apache Syncope: Non-recursive Any search could skip Realms restrictions

Apache Syncope: Nested secrets leak cleartext into audit records readable

Apache Syncope: Incomplete authorization checks for Group members deprovisioning

Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search

Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist

Apache Syncope: ClientApp update entitlement not effective

Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values

Apache Syncope: Groovy Sandbox escape for empty CommandArgs