org.apache.syncope.client.idrepo:syncope-client-idrepo-console

2 results · Feed

• Medium 4.9
  CVE-2026-23795

  Apache Syncope: Console XXE on Keymaster parameters

  Improper Restriction of XML External Entity Reference vulnerability in Apache Syncope Console. An administrator with adequate entitlements to create or edit Keymaster parameters via Console can construct malicious XML text to launch an XXE attack, thereby cau…

  Apache Software Foundation Apache Syncope org.apache.syncope.client.idrepo:syncope-client-idrepo-console Maven
  Feb 3, 2026
• Low 3.9
  CVE-2024-38503

  Apache Syncope: HTML tags can be injected into Console or Enduser text fields

  When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential exploits. The same vulnerability was found in the Syncope Enduser, when editing “Personal Information” or “User Requests”. …

  Apache Software Foundation Apache Syncope org.apache.syncope.client.idrepo:syncope-client-idrepo-console org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui Maven
  Jul 22, 2024