Server-Side Request Forgery (SSRF)

org.apache.syncope.core.idm, syncope-core-idm-logic is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of user-controlled requests, which allows an authenticated low-privileged attacker to make the server send requests to arbitrary internal or...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the REST API. An attacker can access confidential configuration values from other realms by leveraging administrative entitlements in one realm to read connector configurations scoped to another realm...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization due to incomplete security checks in the reconciliation service's pull and push processes. An attacker can gain unauthorized access to restricted resources by making calls as an administrator without the necessar...