Cross site scripting

An issue was discovered in WSO2 Enterprise Integrator 6.4.0. A Reflected Cross-Site Scripting XSS vulnerability has been identified in the Management Console under /carbon/ndatasource/validateconnection/ajaxprocessor.jsp via the driver parameter. Session hijacking or similar attacks would not be...

CVE-2022-39810

An issue was discovered in WSO2 Enterprise Integrator 6.4.0. A Reflected Cross-Site Scripting XSS vulnerability has been identified in the Management Console under /carbon/ndatasource/validateconnection/ajaxprocessor.jsp via the driver parameter. Session hijacking or similar attacks would not be...

CVE-2022-39810

An issue was discovered in WSO2 Enterprise Integrator 6.4.0. A Reflected Cross-Site Scripting XSS vulnerability has been identified in the Management Console under /carbon/ndatasource/validateconnection/ajaxprocessor.jsp via the driver parameter. Session hijacking or similar attacks would not be...

CVE-2022-39810

CVE-2022-39810 affects WSO2 Enterprise Integrator 6.4.0. It is a Reflected Cross-Site Scripting (XSS) vulnerability in the Management Console at /carbon/ndatasource/validateconnection/ajaxprocessor.jsp via the driver parameter. The issue could enable manipulation through the vulnerable input; the...

CVE-2022-39809

CVE-2022-39809 affects WSO2 Enterprise Integrator 6.4.0. A reflected XSS vulnerability exists in the Management Console at /carbon/mediation_secure_vault/properties/ajaxprocessor.jsp via the name parameter. The issue is described as not enabling session hijacking, with the CVE having a CVSS v3.1 ...

CVE-2022-39809

An issue was discovered in WSO2 Enterprise Integrator 6.4.0. A Reflected Cross-Site Scripting XSS vulnerability has been identified in the Management Console under /carbon/mediationsecurevault/properties/ajaxprocessor.jsp via the name parameter. Session hijacking or similar attacks would not be...

CVE-2022-39809

An issue was discovered in WSO2 Enterprise Integrator 6.4.0. A Reflected Cross-Site Scripting XSS vulnerability has been identified in the Management Console under /carbon/mediationsecurevault/properties/ajaxprocessor.jsp via the name parameter. Session hijacking or similar attacks would not be...

PT-2022-25006 · Wso2 · Wso2 Enterprise Integrator

Name of the Vulnerable Software and Affected Versions: WSO2 Enterprise Integrator version 6.4.0 Description: A Reflected Cross-Site Scripting XSS issue has been identified in the Management Console under "/carbon/mediation secure vault/properties/ajaxprocessor.jsp" via the name parameter. This...

WSO2 Enterprise Integrator 跨站脚本漏洞

WSO2 Enterprise Integrator is the United States WSO2 company's set of open source hybrid integration platform. The platform supports communication between multiple applications. A security vulnerability exists in WSO2 Enterprise Integrator version 6.4.0, which is caused by a reflected cross-site...

WSO2 Management Console Cross Site Scripting

Exploit Title: WSO2 Management Console Multiple Products - Unauthenticated Reflected Cross-Site Scripting XSS Date: 21 Apr 2022 Exploit Author: cxosmo Vendor Homepage: https://wso2.com Software Link: API Manager https://wso2.com/api-manager/, Identity Server https://wso2.com/identity-server/,...

WSO2 Management Console (Multiple Products) - Unauthenticated Reflected Cross-Site Scripting (XSS)

Exploit Title: WSO2 Management Console Multiple Products - Unauthenticated Reflected Cross-Site Scripting XSS Date: 21 Apr 2022 Exploit Author: cxosmo Vendor Homepage: https://wso2.com Software Link: API Manager https://wso2.com/api-manager/, Identity Server https://wso2.com/identity-server/,...

WSO2 Management Console (Multiple Products) - Unauthenticated Reflected XSS Exploit

Exploit Title: WSO2 Management Console Multiple Products - Unauthenticated Reflected Cross-Site Scripting XSS Exploit Author: cxosmo Vendor Homepage: https://wso2.com Software Link: API Manager https://wso2.com/api-manager/, Identity Server https://wso2.com/identity-server/, Enterprise Integrator...

Exploit for Path Traversal in Wso2 Api_Manager

Better CVE-2022-29464 Certain WSO2 products allow unrestricte...

Patch Your WSO2: CVE-2022-29464 Exploited to Install Linux-Compatible Cobalt Strike Beacons, Other Malware

Users of WSO2 products are advised to update their respective products and platforms or to apply the temporary mitigation steps immediately...

Exploit for Path Traversal in Wso2 Api_Manager

WSO2 Carbon Server CVE-2022-29464 Pre-auth RCE bug CVE-2022-2...

WSO2 API Manager vulnerable to SSRF

WSO2 API Manager 3.0.0 does not properly restrict outbound network access from a Publisher node, opening up the possibility of SSRF to this node's entire intranet...

GHSA-JFGP-Q2HG-W285 WSO2 API Manager vulnerable to SSRF

WSO2 API Manager 3.0.0 does not properly restrict outbound network access from a Publisher node, opening up the possibility of SSRF to this node's entire intranet...

GHSA-MJWW-VQQW-V78Q WSO2 Carbon directory traversal vulnerability

Directory traversal vulnerability in the LogViewer Admin Service in WSO2 Carbon 4.4.5 allows remote authenticated administrators to read arbitrary files via a .. dot dot in the logFile parameter to downloadgz-ajaxprocessor.jsp...

GHSA-2VCM-2MCR-WMX7 WSO2 Carbon vulnerable to Cross-site Scripting

Multiple cross-site scripting XSS vulnerabilities in WSO2 Carbon 4.4.5 allow remote attackers to inject arbitrary web script or HTML via the 1 setName parameter to identity-mgt/challenges-mgt.jsp; the 2 webappType or 3 httpPort parameter to webapp-list/webappinfo.jsp; the 4 dsName or 5 descriptio...

WSO2 Carbon directory traversal vulnerability

Directory traversal vulnerability in the LogViewer Admin Service in WSO2 Carbon 4.4.5 allows remote authenticated administrators to read arbitrary files via a .. dot dot in the logFile parameter to downloadgz-ajaxprocessor.jsp...