Wso2
Page 2 of 2 — Wso2 CVEs from a corpus of 151, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-29464 | Critical | 9.8 | 2022-04-18 | Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposit… |
CVE-2021-36760 | Medium | 6.1 | 2021-12-07 | In accountrecoveryendpoint/recoverpassword.do in WSO2 Identity Server 5.7.0, it is possible to perform a DOM-Based XSS attack affecting the callback parameter… |
CVE-2020-17453 | Medium | 6.1 | 2021-04-05 | WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter. |
CVE-2020-27885 | Medium | 6.1 | 2020-10-29 | Cross-Site Scripting (XSS) vulnerability on WSO2 API Manager 3.1.0. By exploiting a Cross-site scripting vulnerability the attacker can hijack a logged-in user… |
CVE-2020-25516 | Medium | 5.4 | 2020-10-29 | WSO2 Enterprise Integrator 6.6.0 or earlier contains a stored cross-site scripting (XSS) vulnerability in BPMN explorer tasks. |
CVE-2020-17454 | Medium | 6.1 | 2020-10-21 | WSO2 API Manager 3.1.0 and earlier has reflected XSS on the "publisher" component's admin interface. More precisely, it is possible to inject an XSS payload in… |
CVE-2020-24706 | Medium | 6.1 | 2020-08-27 | An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager through 3.1.0, API Manager Analytics 2.5.0, IS… |
CVE-2020-24705 | High | 8.8 | 2020-08-27 | An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-controlled server if the victim s… |
CVE-2020-24704 | Medium | 6.1 | 2020-08-27 | An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager 2.2.0, API Manager Analytics 2.2.0, API Microg… |
CVE-2020-24703 | High | 8.8 | 2020-08-27 | An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-controlled server if the victim s… |
CVE-2020-24591 | Medium | 6.5 | 2020-08-21 | The Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates. This affects API Manager through 3.0.0, API Manager Analytics… |
CVE-2020-24590 | Critical | 9.1 | 2020-08-21 | The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML Entity Expansion attacks. |
CVE-2020-24589 | Critical | 9.1 | 2020-08-21 | The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML External Entity injection (XXE) attacks. |
CVE-2020-14446 | Medium | 6.1 | 2020-06-18 | An issue was discovered in WSO2 Identity Server through 5.10.0 and WSO2 IS as Key Manager through 5.10.0. An open redirect exists. |
CVE-2020-14445 | Medium | 5.4 | 2020-06-18 | An issue was discovered in WSO2 Identity Server through 5.9.0 and WSO2 IS as Key Manager through 5.9.0. A potential Reflected Cross-Site Scripting (XSS) vulner… |
CVE-2020-14444 | Medium | 5.4 | 2020-06-18 | An issue was discovered in WSO2 Identity Server through 5.9.0 and WSO2 IS as Key Manager through 5.9.0. A potential Reflected Cross-Site Scripting (XSS) vulner… |
CVE-2020-13883 | Medium | 6.7 | 2020-06-06 | In WSO2 API Manager 3.0.0 and earlier, WSO2 API Microgateway 2.2.0, and WSO2 IS as Key Manager 5.9.0 and earlier, Management Console allows XXE during addition… |
CVE-2020-13226 | Critical | 9.8 | 2020-05-20 | WSO2 API Manager 3.0.0 does not properly restrict outbound network access from a Publisher node, opening up the possibility of SSRF to this node's entire intra… |
CVE-2020-12719 | High | 7.2 | 2020-05-08 | XXE during an EventPublisher update can occur in Management Console in WSO2 API Manager 3.0.0 and earlier, API Manager Analytics 2.5.0 and earlier, API Microga… |
CVE-2020-11885 | High | 7.2 | 2020-04-17 | WSO2 Enterprise Integrator through 6.6.0 has an XXE vulnerability where a user (with admin console access) can use the XML validator to make unintended network… |
CVE-2019-10797 | Medium | 6.5 | 2020-02-19 | Netty in WSO2 transport-http before v6.3.1 is vulnerable to HTTP Response Splitting due to HTTP Header validation being disabled. |
CVE-2019-20439 | Medium | 4.8 | 2020-01-28 | An issue was discovered in WSO2 API Manager 2.6.0. A potential Reflected Cross-Site Scripting (XSS) vulnerability has been identified in defining a scope in th… |
CVE-2019-20438 | Medium | 4.8 | 2020-01-28 | An issue was discovered in WSO2 API Manager 2.6.0. A potential stored Cross-Site Scripting (XSS) vulnerability has been identified in the inline API documentat… |
CVE-2019-20437 | Medium | 6.1 | 2020-01-28 | An issue was discovered in WSO2 API Manager 2.6.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. When a custom claim dialect with an XSS payloa… |
CVE-2019-20436 | Medium | 6.1 | 2020-01-28 | An issue was discovered in WSO2 API Manager 2.6.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. If there is a claim dialect configured with an… |
CVE-2019-20435 | Medium | 4.8 | 2020-01-28 | An issue was discovered in WSO2 API Manager 2.6.0. A reflected XSS attack could be performed in the inline API documentation editor page of the API Publisher b… |
CVE-2019-20434 | Medium | 4.8 | 2020-01-28 | An issue was discovered in WSO2 API Manager 2.6.0. A potential Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the Datasource creatio… |
CVE-2019-20443 | Medium | 4.8 | 2020-01-28 | An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. A potential… |
CVE-2019-20442 | Medium | 4.8 | 2020-01-28 | An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. A potential… |
CVE-2019-20441 | Medium | 4.8 | 2020-01-28 | An issue was discovered in WSO2 API Manager 2.6.0. A potential Stored Cross-Site Scripting (XSS) vulnerability has been identified in the 'implement phase' of… |
CVE-2019-20440 | Medium | 4.8 | 2020-01-28 | An issue was discovered in WSO2 API Manager 2.6.0. A potential Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the update API documen… |
CVE-2019-19587 | Medium | 6.1 | 2019-12-05 | In WSO2 Enterprise Integrator 6.5.0, reflected XSS occurs when updating the message processor configuration from the source view in the Management Console. |
CVE-2019-18882 | Medium | 6.1 | 2019-11-12 | WSO2 IS as Key Manager 5.7.0 allows stored XSS in download-userinfo.jag because Content-Type is mishandled. |
CVE-2019-18881 | Medium | 6.1 | 2019-11-12 | WSO2 IS as Key Manager 5.7.0 allows unauthenticated reflected XSS in the dashboard user profile. |
CVE-2019-15108 | Medium | 4.8 | 2019-08-16 | An issue was discovered in WSO2 API Manager 2.6.0 before WSO2-CARBON-PATCH-4.4.0-4457. There is XSS via a crafted filename to the file-upload feature of the ev… |
CVE-2019-6513 | Medium | 5.4 | 2019-05-21 | An issue was discovered in WSO2 API Manager 2.6.0. It is possible for a logged-in user to upload, as API documentation, any type of file by changing the extens… |
CVE-2019-6516 | Medium | 5.8 | 2019-05-14 | An issue was discovered in WSO2 Dashboard Server 2.0.0. It is possible to force the application to perform requests to the internal workstation (port-scanning)… |
CVE-2019-6515 | Medium | 5.3 | 2019-05-14 | An issue was discovered in WSO2 API Manager 2.6.0. Uploaded documents for API documentation are available to an unauthenticated user. |
CVE-2019-6514 | Medium | 4.8 | 2019-05-14 | An issue was discovered in WSO2 Dashboard Server 2.0.0. It is possible to inject a JavaScript payload that will be stored in the database and then displayed an… |
CVE-2019-6512 | Medium | 4.1 | 2019-05-14 | An issue was discovered in WSO2 API Manager 2.6.0. It is possible to force the application to perform requests to the internal workstation (SSRF port-scanning)… |
CVE-2018-20737 | Medium | 5.4 | 2019-03-21 | An issue was discovered in WSO2 API Manager 2.1.0 and 2.6.0. Reflected XSS exists in the carbon part of the product. |
CVE-2018-20736 | Medium | 5.4 | 2019-03-21 | An issue was discovered in WSO2 API Manager 2.1.0 and 2.6.0. A DOM-based XSS exists in the store part of the product. |
CVE-2018-8716 | Medium | 5.4 | 2018-04-25 | WSO2 Identity Server before 5.5.0 has XSS via the dashboard, allowing attacks by low-privileged attackers. |
CVE-2017-14995 | Medium | 6.1 | 2017-10-04 | The Management Console in WSO2 Application Server 5.3.0, WSO2 Business Process Server 3.6.0, WSO2 Business Rules Server 2.2.0, WSO2 Complex Event Processor 4.2… |
CVE-2017-14651 | Medium | 4.8 | 2017-09-21 | WSO2 Data Analytics Server 3.1.0 has XSS in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter. |
CVE-2016-4327 | Medium | 6.1 | 2017-02-17 | Cross-site scripting (XSS) vulnerability in WSO2 SOA Enablement Server for Java/6.6 build SSJ-6.6-20090827-1616 and earlier allows remote attackers to inject a… |
CVE-2016-4316 | Medium | 6.1 | 2017-02-17 | Multiple cross-site scripting (XSS) vulnerabilities in WSO2 Carbon 4.4.5 allow remote attackers to inject arbitrary web script or HTML via the (1) setName para… |
CVE-2016-4315 | Medium | 5.7 | 2017-02-17 | Cross-site request forgery (CSRF) vulnerability in WSO2 Carbon 4.4.5 allows remote attackers to hijack the authentication of privileged users for requests that… |
CVE-2016-4314 | Medium | 4.9 | 2017-02-17 | Directory traversal vulnerability in the LogViewer Admin Service in WSO2 Carbon 4.4.5 allows remote authenticated administrators to read arbitrary files via a… |
CVE-2016-4312 | High | 7.5 | 2017-02-17 | XML external entity (XXE) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 before WSO2-CARBON-PATCH-4.4.0-0231 allows remote authenticated… |
CVE-2016-4311 | High | 8.8 | 2017-02-17 | Cross-site request forgery (CSRF) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 allows remote attackers to hijack the authentication of… |