CVE-2020-14446

An issue was discovered in WSO2 Identity Server through 5.10.0 and WSO2 IS as Key Manager through 5.10.0. An open redirect exists...

CVE-2020-14446: URL Redirection to Untrusted Site

An issue was discovered in WSO2 Identity Server through 5.10.0 and WSO2 IS as Key Manager through 5.10.0. An open redirect exists...

CVE-2020-13883: Improper Restriction of XML External Entity Reference

In WSO2 API Manager 3.0.0 and earlier, WSO2 API Microgateway 2.2.0, and WSO2 IS as Key Manager 5.9.0 and earlier, Management Console allows XXE during addition or update of a Lifecycle...

PT-2020-13748

Name of the Vulnerable Software and Affected Versions WSO2 API Manager versions 3.0.0 and earlier WSO2 API Microgateway version 2.2.0 WSO2 IS as Key Manager versions 5.9.0 and earlier Description The issue allows XXE XML External Entity attacks during the addition or update of a Lifecycle in the...

CVE-2019-20442

An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. A potential stored Cross-Site Scripting XSS vulnerability in roleToAuthorize has been identified in the registry UI...

CVE-2019-20437: Improper Neutralization of Input During Web Page Generation

An issue was discovered in WSO2 API Manager 2.6.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. When a custom claim dialect with an XSS payload is configured in the identity provider basic claim configuration, that payload gets executed, if a user picks up that dialect's URI as t...

CVE-2019-20436: Improper Neutralization of Input During Web Page Generation

An issue was discovered in WSO2 API Manager 2.6.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. If there is a claim dialect configured with an XSS payload in the dialect URI, and a user picks up this dialect's URI and adds it as the service provider claim dialect while configurin...

CVE-2019-20443: Improper Neutralization of Input During Web Page Generation

An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. A potential stored Cross-Site Scripting XSS vulnerability in mediaType has been identified in the registry UI...

PT-2020-10453

Name of the Vulnerable Software and Affected Versions WSO2 API Manager version 2.6.0 WSO2 Enterprise Integrator version 6.5.0 WSO2 IS as Key Manager version 5.7.0 WSO2 Identity Server version 5.8.0 Description A potential stored Cross-Site Scripting XSS vulnerability has been identified in the...

CVE-2019-20442: Improper Neutralization of Input During Web Page Generation

An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. A potential stored Cross-Site Scripting XSS vulnerability in roleToAuthorize has been identified in the registry UI...

PT-2020-10454

Name of the Vulnerable Software and Affected Versions WSO2 API Manager version 2.6.0 WSO2 Enterprise Integrator version 6.5.0 WSO2 IS as Key Manager version 5.7.0 WSO2 Identity Server version 5.8.0 Description A potential stored Cross-Site Scripting XSS vulnerability has been identified in the...

PT-2019-15710

Name of the Vulnerable Software and Affected Versions WSO2 IS as Key Manager version 5.7.0 Description The issue allows for stored XSS in the download-userinfo.jag component due to mishandling of the Content-Type. Recommendations For WSO2 IS as Key Manager version 5.7.0, update the software to a...

PT-2019-15709

Name of the Vulnerable Software and Affected Versions WSO2 IS as Key Manager version 5.7.0 Description The issue allows unauthenticated reflected XSS in the dashboard user profile. Recommendations For version 5.7.0, update to a newer version that contains a fix for this issue...

CVE-2019-18882: Improper Neutralization of Input During Web Page Generation

WSO2 IS as Key Manager 5.7.0 allows stored XSS in download-userinfo.jag because Content-Type is mishandled...

CVE-2019-18881: Improper Neutralization of Input During Web Page Generation

WSO2 IS as Key Manager 5.7.0 allows unauthenticated reflected XSS in the dashboard user profile...