Code injection

An issue was discovered in WSO2 API Manager 2.6.0. Uploaded documents for API documentation are available to an unauthenticated user...

CVE-2019-6512

An issue was discovered in WSO2 API Manager 2.6.0. It is possible to force the application to perform requests to the internal workstation SSRF port-scanning, other adjacent workstations SSRF network scanning, or to enumerate files because of the existence of the file:// wrapper...

CVE-2019-6515

An issue was discovered in WSO2 API Manager 2.6.0. Uploaded documents for API documentation are available to an unauthenticated user...

CVE-2019-6512

An issue was discovered in WSO2 API Manager 2.6.0. It is possible to force the application to perform requests to the internal workstation SSRF port-scanning, other adjacent workstations SSRF network scanning, or to enumerate files because of the existence of the file:// wrapper...

CVE-2019-6515

Technical details (affected products, components, impact, remediation) are not publicly available in the provided documents. Monitor for updates.

CVE-2019-6512

An issue was discovered in WSO2 API Manager 2.6.0. It is possible to force the application to perform requests to the internal workstation SSRF port-scanning, other adjacent workstations SSRF network scanning, or to enumerate files because of the existence of the file:// wrapper...

CVE-2019-6512: Server-Side Request Forgery (SSRF)

An issue was discovered in WSO2 API Manager 2.6.0. It is possible to force the application to perform requests to the internal workstation SSRF port-scanning, other adjacent workstations SSRF network scanning, or to enumerate files because of the existence of the file:// wrapper...

PT-2019-18133

Name of the Vulnerable Software and Affected Versions WSO2 API Manager version 2.6.0 Description An issue was discovered where uploaded documents for API documentation are accessible to unauthenticated users. Recommendations For WSO2 API Manager version 2.6.0, restrict access to uploaded API...

CVE-2019-6515: Undefined Security Weakness

An issue was discovered in WSO2 API Manager 2.6.0. Uploaded documents for API documentation are available to an unauthenticated user...

PT-2019-18130

Name of the Vulnerable Software and Affected Versions WSO2 API Manager version 2.6.0 Description An issue in WSO2 API Manager allows forcing the application to perform requests to the internal workstation, enabling SSRF port-scanning, or to adjacent workstations for SSRF network scanning. It also...

CVE-2018-20737

An issue was discovered in WSO2 API Manager 2.1.0 and 2.6.0. Reflected XSS exists in the carbon part of the product...

CVE-2018-20736

An issue was discovered in WSO2 API Manager 2.1.0 and 2.6.0. A DOM-based XSS exists in the store part of the product...

Design/Logic Flaw

An issue was discovered in WSO2 API Manager 2.1.0 and 2.6.0. A DOM-based XSS exists in the store part of the product...

Cross site scripting

An issue was discovered in WSO2 API Manager 2.1.0 and 2.6.0. Reflected XSS exists in the carbon part of the product...

CVE-2018-20736

CVE-2018-20736 affects WSO2 API Manager 2.1.0 and 2.6.0. The issue is a DOM-based XSS in the store component. Connected sources do not provide exploitation details. The NVD entry lists CVSSv3 base score 5.4 (Medium) and network attack with user interaction required. Patches/mitigations are refere...

CVE-2018-20737

An issue was discovered in WSO2 API Manager 2.1.0 and 2.6.0. Reflected XSS exists in the carbon part of the product...

PT-2019-10195

Name of the Vulnerable Software and Affected Versions: WSO2 API Manager versions 2.1.0 through 2.6.0 Description: A reflected XSS issue exists in the carbon part of the product. Recommendations: For versions 2.1.0 through 2.6.0, update to a version that includes a fix for this issue...

CVE-2018-20736: Improper Neutralization of Input During Web Page Generation

An issue was discovered in WSO2 API Manager 2.1.0 and 2.6.0. A DOM-based XSS exists in the store part of the product...

CVE-2018-20737: Improper Neutralization of Input During Web Page Generation

An issue was discovered in WSO2 API Manager 2.1.0 and 2.6.0. Reflected XSS exists in the carbon part of the product...

PT-2019-10194

Name of the Vulnerable Software and Affected Versions: WSO2 API Manager versions 2.1.0 through 2.6.0 Description: A DOM-based XSS issue exists in the store part of the product, which may allow for malicious script execution. Recommendations: For WSO2 API Manager versions 2.1.0 through 2.6.0, upda...