379 matches found
CVE-2020-24703
An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-controlled server if the victim submits a crafted Try It request, aka Session Hijacking. This affects API Manager 2.2.0, API Manager Analytics 2.2.0, API Microgateway 2.2....
Improper Authentication
Overview Affected versions of this package are vulnerable to Improper Authentication due to insufficient validation of the cnf claim in DPoP access tokens. An attacker can use leaked DPoP access tokens at local API endpoints without possessing the private key for signing proof tokens. Note: This ...
CVE-2024-7211
The 1E Platform's component utilized the third-party Duende Identity Server, which suffered from an open redirect vulnerability, permitting an attacker to control the redirection path of end users. Note: 1E Platform's component utilizing the third-party Duende Identity Server has been updated wit...
CVE-2024-7211
The 1E Platform's component utilized the third-party Duende Identity Server, which suffered from an open redirect vulnerability, permitting an attacker to control the redirection path of end users. Note: 1E Platform's component utilizing the third-party Duende Identity Server has been updated wit...
CVE-2024-7211
CVE-2024-7211 affects the 1E Platform through a component that uses the third‑party Duende Identity Server, which contains an open redirect vulnerability that could let an attacker control the redirection path to untrusted sites. The vulnerability stems from the Duende Identity Server integration...
CVE-2024-7211 The Duende Identity Server based component in 1E Platform may allow URL redirections to untrusted websites.
The 1E Platform's component utilized the third-party Duende Identity Server, which suffered from an open redirect vulnerability, permitting an attacker to control the redirection path of end users. Note: 1E Platform's component utilizing the third-party Duende Identity Server has been updated wit...
CVE-2024-7211 The Duende Identity Server based component in 1E Platform may allow URL redirections to untrusted websites.
The 1E Platform's component utilized the third-party Duende Identity Server, which suffered from an open redirect vulnerability, permitting an attacker to control the redirection path of end users. Note: 1E Platform's component utilizing the third-party Duende Identity Server has been updated wit...
PT-2024-38171 · 1E +1 · 1E Platform +1
Name of the Vulnerable Software and Affected Versions: 1E Platform affected versions not specified Duende Identity Server affected versions not specified Description: The issue concerns an open redirect vulnerability in the Duende Identity Server, a third-party component used by the 1E Platform...
1E Platform 安全漏洞
1E Platform is a terminal endpoint management and automation solution from 1E. A security vulnerability exists in versions prior to 1E Platform 23 that stems from an identity server that can enable URL redirection to untrusted sites...
CVE-2023-36085
The sisqualWFM 7.1.319.103 thru 7.1.319.111 for Android, has a host header injection vulnerability in its "/sisqualIdentityServer/core/" endpoint. By modifying the HTTP Host header, an attacker can change webpage links and even redirect users to arbitrary or malicious locations. This can lead to...
PT-2023-25424 · Unknown · Sisqualwfm
Name of the Vulnerable Software and Affected Versions: sisqualWFM versions 7.1.319.103 through 7.1.319.111 Description: The issue concerns a host header injection vulnerability in the "/sisqualIdentityServer/core/" endpoint. By modifying the HTTP Host header, an attacker can change webpage links...
PYSEC-2023-139
Sydent is an identity server for the Matrix communications protocol. Prior to version 2.5.6, if configured to send emails using TLS, Sydent does not verify SMTP servers' certificates. This makes Sydent's emails vulnerable to interception via a man-in-the-middle MITM attack. Attackers with...
Code injection
Sydent is an identity server for the Matrix communications protocol. Prior to version 2.5.6, if configured to send emails using TLS, Sydent does not verify SMTP servers' certificates. This makes Sydent's emails vulnerable to interception via a man-in-the-middle MITM attack. Attackers with...
CVE-2023-38686
Sydent (Matrix Identity Server) is affected pre-2.5.6: when configured to send emails via TLS, it does not verify SMTP server certificates, enabling MITM interception of invitation and address-confirmation emails by an attacker with network access. Root cause: failure to verify TLS SMTP certifica...
CVE-2023-38686 Sydent does not verify email server certificates
Sydent is an identity server for the Matrix communications protocol. Prior to version 2.5.6, if configured to send emails using TLS, Sydent does not verify SMTP servers' certificates. This makes Sydent's emails vulnerable to interception via a man-in-the-middle MITM attack. Attackers with...
CVE-2023-38686
Removed by vendor...
WSO2 Identity Server Cross Site Scripting (CVE-2018-8716)
A cross-site scripting vulnerability exists in WSO2 Identity Server. Successful exploitation of this vulnerability would allow remote attackers to inject arbitrary web script into the affected system...
WSO2 Management Console Cross Site Scripting
Exploit Title: WSO2 Management Console Multiple Products - Unauthenticated Reflected Cross-Site Scripting XSS Date: 21 Apr 2022 Exploit Author: cxosmo Vendor Homepage: https://wso2.com Software Link: API Manager https://wso2.com/api-manager/, Identity Server https://wso2.com/identity-server/,...
WSO2 Management Console (Multiple Products) - Unauthenticated Reflected Cross-Site Scripting (XSS)
Exploit Title: WSO2 Management Console Multiple Products - Unauthenticated Reflected Cross-Site Scripting XSS Date: 21 Apr 2022 Exploit Author: cxosmo Vendor Homepage: https://wso2.com Software Link: API Manager https://wso2.com/api-manager/, Identity Server https://wso2.com/identity-server/,...
