WSO2 API Manager and WSO2 Open Banking AM have cross-site scripting vulnerabilities

WSO2 API Manager and WSO2 Open Banking AM are products of WSO2, Inc. WSO2 API Manager is an API lifecycle management solution and WSO2 Open Banking AM is an open banking gas pedal. A security vulnerability exists in WSO2 API Manager and WSO2 Open Banking AM that stems from improper input validati...

CVE-2020-12719

XXE during an EventPublisher update can occur in Management Console in WSO2 API Manager 3.0.0 and earlier, API Manager Analytics 2.5.0 and earlier, API Microgateway 2.2.0, Enterprise Integrator 6.4.0 and earlier, IS as Key Manager 5.9.0 and earlier, Identity Server 5.9.0 and earlier, and Identity...

CVE-2020-24703

An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-controlled server if the victim submits a crafted Try It request, aka Session Hijacking. This affects API Manager 2.2.0, API Manager Analytics 2.2.0, API Microgateway 2.2....

CVE-2020-24590

The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML Entity Expansion attacks...

CVE-2020-24589

The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML External Entity injection XXE attacks...

Exploit for Path Traversal in Wso2 Api_Manager

Exploit CVE-2022-29464 Este repositorio contiene un script pa...

PT-2025-3690

Name of the Vulnerable Software and Affected Versions WSO2 API Manager affected versions not specified Description The issue allows for unauthenticated account creation, potentially leading to a fully compromised system. It requires the WSDLs of admin services to be enabled first. Recommendations...

Metasploit Wrap-Up 01/10/2025

New module content 5 OneDev Unauthenticated Arbitrary File Read Authors: Siebene and vultza Type: Auxiliary Pull request: 19614 contributed by vultza Path: gather/onedevarbitraryfileread AttackerKB reference: CVE-2024-45309 Description: This adds an exploit module for an unauthenticated arbitrary...

PT-2024-38061 · Wso2 · Wso2 Api Manager

Name of the Vulnerable Software and Affected Versions: WSO2 API Manager affected versions not specified Description: The issue allows remote attackers to execute arbitrary code on affected installations of WSO2 API Manager. Authentication is required to exploit this issue. The specific flaw exist...

WSO2 API Manager SynapseArtifactUploaderAdmin Unrestricted File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of WSO2 API Manager. Authentication is required to exploit this vulnerability. The specific flaw exists within the SynapseArtifactUploaderAdmin endpoint, which listens on TCP port 9443 by default. The...

WSO2 API Manager Exposed Dangerous Function Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of WSO2 API Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the user self-registration process. The issue results from the...

PT-2024-37954

Name of the Vulnerable Software and Affected Versions WSO2 API Manager affected versions not specified Description The issue allows remote attackers to bypass authentication on affected installations. Authentication is not required to exploit this issue. The specific flaw exists in an exposed...

CVE-2024-7870: Improper Authentication

The PixelYourSite – Your smart PIXEL TAG & API Manager and the PixelYourSite PRO plugins for WordPress are vulnerable to Sensitive Information Exposure in all versions up to, and including, 9.7.1 and 10.4.2, respectively, through publicly exposed log files. This makes it possible for...

WSO2 API Manager Documentation File Upload Remote Code Execution

A vulnerability in the 'Add API Documentation' feature allows malicious users with specific permissions /permission/admin/login and /permission/admin/manage/api/publish to upload arbitrary files to a user-controlled server location. This flaw could be exploited to execute remote code, enabling an...

VulnCheck KEV: CVE-2020-24589

The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML External Entity injection XXE attacks...

GHSA-W7RX-824V-RGX5 WSO2 API Manager allows attackers to change the API rating

Multiple WSO2 products have been identified as vulnerable due to lack of server-side input validation in the Forum feature, API rating could be manipulated...

WSO2 API Manager allows attackers to change the API rating

Multiple WSO2 products have been identified as vulnerable due to lack of server-side input validation in the Forum feature, API rating could be manipulated...

WSO2 API Manager Security Vulnerability

WSO2 API Manager is a suite of API lifecycle management solutions from WSO2, USA. A security vulnerability exists in WSO2 API Manager that stems from a potential user emulation vulnerability in federated authentication using JIT configuration when certain configurations are enabled...

WSO2 API Manager Security Vulnerability

WSO2 API Manager is an API lifecycle management solution from WSO2, Inc. A security vulnerability exists in WSO2 API Manager that stems from the lack of server-side input validation in the API Store...

WSO2 API Manager Security Vulnerability

WSO2 API Manager is an API lifecycle management solution from WSO2, Inc. A security vulnerability exists in WSO2 API Manager that stems from an XML external entity injection vulnerability...