CVE-2019-20443

An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. A potential stored Cross-Site Scripting XSS vulnerability in mediaType has been identified in the registry UI...

Cross site scripting

An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. A potential stored Cross-Site Scripting XSS vulnerability in roleToAuthorize has been identified in the registry UI...

CVE-2019-20437

CVE-2019-20437 affects WSO2 API Manager 2.6.0, WSO2 Identity Server 5.8.0, and WSO2 IS as Key Manager 5.7.0. A custom claim dialect with an XSS payload can execute when a user selects the dialect URI as the provisioning claim in the identity provider’s advanced claim configuration, provided the a...

CVE-2019-20442

An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. A potential stored Cross-Site Scripting XSS vulnerability in roleToAuthorize has been identified in the registry UI...

CVE-2019-20443

CVE-2019-20443 affects WSO2 products: API Manager 2.6.0, Enterprise Integrator 6.5.0, Identity Server 5.8.0, and related Key Manager 5.7.0. The issue is a potential stored Cross-Site Scripting (XSS) in the registry UI due to improper handling of mediaType in the UI component. Impact described acr...

CVE-2019-20436

Affected software: WSO2 API Manager 2.6.0; WSO2 IS as Key Manager 5.7.0; WSO2 Identity Server 5.8.0. Issue: configuring a claim dialect whose URI contains an XSS payload can cause execution when the URI is added as a service provider claim dialect during SP configuration, given the attacker has a...

PT-2020-10447 · Wso2 · Wso2 Identity Server +2

Name of the Vulnerable Software and Affected Versions: WSO2 API Manager version 2.6.0 WSO2 IS as Key Manager version 5.7.0 WSO2 Identity Server version 5.8.0 Description: An issue was discovered where if a claim dialect is configured with an XSS payload in the dialect URI, and a user adds this...

PT-2020-10453

Name of the Vulnerable Software and Affected Versions WSO2 API Manager version 2.6.0 WSO2 Enterprise Integrator version 6.5.0 WSO2 IS as Key Manager version 5.7.0 WSO2 Identity Server version 5.8.0 Description A potential stored Cross-Site Scripting XSS vulnerability has been identified in the...

PT-2020-10454

Name of the Vulnerable Software and Affected Versions WSO2 API Manager version 2.6.0 WSO2 Enterprise Integrator version 6.5.0 WSO2 IS as Key Manager version 5.7.0 WSO2 Identity Server version 5.8.0 Description A potential stored Cross-Site Scripting XSS vulnerability has been identified in the...

CVE-2019-20443: Improper Neutralization of Input During Web Page Generation

An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. A potential stored Cross-Site Scripting XSS vulnerability in mediaType has been identified in the registry UI...

CVE-2019-20436: Improper Neutralization of Input During Web Page Generation

An issue was discovered in WSO2 API Manager 2.6.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. If there is a claim dialect configured with an XSS payload in the dialect URI, and a user picks up this dialect's URI and adds it as the service provider claim dialect while configurin...

CVE-2019-20437: Improper Neutralization of Input During Web Page Generation

An issue was discovered in WSO2 API Manager 2.6.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. When a custom claim dialect with an XSS payload is configured in the identity provider basic claim configuration, that payload gets executed, if a user picks up that dialect's URI as t...

CVE-2019-20442: Improper Neutralization of Input During Web Page Generation

An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. A potential stored Cross-Site Scripting XSS vulnerability in roleToAuthorize has been identified in the registry UI...

WSO2 Identity Server Cross-Site Scripting Vulnerability (CNVD-2020-02586)

WSO2 Identity Server IS is an identity server from the American company WSO2. A cross-site scripting vulnerability exists in WSO2 IS version 5.7.0. The vulnerability stems from the lack of proper validation of client data by the WEB application. An attacker can exploit the vulnerability to execut...

WSO2 Identity Server Cross-Site Scripting Vulnerability (CNVD-2020-02585)

WSO2 Identity Server IS is an identity server from the American company WSO2. A cross-site scripting vulnerability exists in WSO2 IS version 5.7.0. The vulnerability stems from the lack of proper validation of client data by the WEB application. An attacker can exploit the vulnerability to execut...

CVE-2019-18881

WSO2 IS as Key Manager 5.7.0 allows unauthenticated reflected XSS in the dashboard user profile...

CVE-2019-18882

WSO2 IS as Key Manager 5.7.0 allows stored XSS in download-userinfo.jag because Content-Type is mishandled...

Cross site scripting

WSO2 IS as Key Manager 5.7.0 allows unauthenticated reflected XSS in the dashboard user profile...

Information Disclosure

cloudfoundry-identity-server is vulnerable to information disclosure. A remotely authenticated attacker with scim.invite scope is able to obtain information about users of the UAA via blind SCIM injection through the email parameter...

Privilege Escalation

cloudfoundry-identity-server is vulnerable to privilege escalation. External input is directly appended to an SCIM query, allowing a remote attacker with client.write and groups.update to inject and execute a malicious SCIM query. This allows the retrieval of confidential information that allows ...