Mass-exploit-CVE-2022-29464

ニャーニャーニャー！ WSO2 Carbon Server のPython PoCに基づいた大量エクスプロイトです CVE-2022-29464 認証前RCEバグ CVE-2022-29464. ニャーニャーニャー？必要なもの？ Python3 Shodan Zoomeye 頭脳 このツールは何ですか？ これは、第三者によってPythonで書かれたPoCに基づいた、CVE-2022-29464の大量自動スキャンエクスプロイトです。 Pyファイルは利用可能で読み取り可能です。また、エンコードされた文字列を含まないbashスクリプトも参照してください。...

CVE-2022-29464-mass

WSO2 Carbon Server CVE-2022-29464 Pre-auth RCEバグ CVE-2022-29464。 作者: Chocapikk trhacknon による軽微な改造 使い方 python exploit.py -u または: python exploit.py -f Zoomeye Dork CLI: zoomeye search 'title:"WSO2 Management Console"' -num 10 -filter=ip,port WEB: title:"WSO2 Management Console" Google dorks...

WSO2-2020-0731

WSO2-2020-0731: WSO2 Carbon 中的 XXE 和 XSS 漏洞 已在多个 WSO2 产品中发现潜在的 XXE 和 XSS 漏洞。 厂商披露： 此漏洞的厂商披露和修复可在此处找到。 为什么没有 CVE？ 我和厂商都没有为这些漏洞申请 CVE。 要求： 此漏洞需要： 诱使合法的 WSO2 用户添加恶意仓库 或 有效的用户凭据 概念验证： 更多详情和利用过程可在此 PDF 中找到。...

WSO2-CVE-2022-29464

WSO2 Carbon Server CVE-2022-29464 事前認証RCEバグ CVE-2022-29464。完全な技術的分析は私のブログ記事で公開予定です： https://mr-r3bot.github.io 使い方 python exploit.py -u...

CVE-2025-12737

CVE-2025-12737 affects WSO2 products via the Carbon Console . Administrative operations within the console do not adequately validate specific user-supplied input, allowing a threat actor with administrative privileges to inject and execute arbitrary code remotely , leading to complete compromise...

CVE-2025-12737 Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative...

CVE-2025-12737 Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution

The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a malicious actor with administrative privileges to inject and execute arbitrary code remotely. Successful exploitation enables a threat actor with administrative...

CVE-2026-0637

When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties. This logging occurs without sufficient validation or sanitization of the property values. A malicious actor with access to the 'wso2carbon' log files could retrieve sensiti...

WSO2 Carbon Mediation vulnerable to XML External Entity (XXE) attacks

An XML External Entity XXE vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser. The application parses user-supplied XML without applying sufficient restrictions, allowing resolution of external entities. A successful attack could enable a remote,...

EUVD-2016-5315

Malware in sbrugna...

EUVD-2016-5316

Malware in sbrugna...

EUVD-2022-7654

Malicious code in bioql PyPI...

EUVD-2022-7634

Malicious code in bioql PyPI...

Incorrect Authorization

Overview org.wso2.carbon:org.wso2.carbon.user.core is a component of the next-generation WSO2 Carbon platform Affected versions of this package are vulnerable to Incorrect Authorization via flawed authorization logic in the isUserAuthorized function in the file JDBCAuthorizationManager.java. An...

Cross-site Scripting (XSS)

Overview org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui is an User Store UI component for WSO2 Carbon Affected versions of this package are vulnerable to Cross-site Scripting XSS due to insufficient output encoding in error messages generated by the JDBC...

CVE-2022-4520

A vulnerability was found in WSO2 carbon-registry up to 4.8.11. It has been rated as problematic. Affected by this issue is some unknown functionality of the file components/registry/org.wso2.carbon.registry.search.ui/src/main/resources/web/search/advancedSearchForm-ajaxprocessor.jsp of the...

CVE-2022-4521

A vulnerability classified as problematic has been found in WSO2 carbon-registry up to 4.8.6. This affects an unknown part of the component Request Parameter Handler. The manipulation of the argument parentPath/path/username/path/profilemenu leads to cross site scripting. It is possible to initia...

GHSA-J34R-57XJ-PFM5 WSO2 carbon-registry Cross-site Scripting vulnerability

A vulnerability was found in WSO2 carbon-registry up to 4.8.11. It has been rated as problematic. Affected by this issue is some unknown functionality of the file components/registry/org.wso2.carbon.registry.search.ui/src/main/resources/web/search/advancedSearchForm-ajaxprocessor.jsp of the...

CVE-2022-4521

A vulnerability classified as problematic has been found in WSO2 carbon-registry up to 4.8.6. This affects an unknown part of the component Request Parameter Handler. The manipulation of the argument parentPath/path/username/path/profilemenu leads to cross site scripting. It is possible to initia...

CVE-2022-4521

A vulnerability classified as problematic has been found in WSO2 carbon-registry up to 4.8.6. This affects an unknown part of the component Request Parameter Handler. The manipulation of the argument parentPath/path/username/path/profilemenu leads to cross site scripting. It is possible to initia...