Server side request forgery (ssrf)

XML external entity XXE vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 before WSO2-CARBON-PATCH-4.4.0-0231 allows remote authenticated users with access to XACML features to read arbitrary files, cause a denial of service, conduct server-side request forgery SSRF attacks, o...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 allows remote attackers to hijack the authentication of privileged users for requests that process XACML requests via an entitlement/eval-policy-submit.jsp request...

CVE-2016-4312

XML external entity XXE vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 before WSO2-CARBON-PATCH-4.4.0-0231 allows remote authenticated users with access to XACML features to read arbitrary files, cause a denial of service, conduct server-side request forgery SSRF attacks, o...

CVE-2016-4327

Cross-site scripting XSS vulnerability in WSO2 SOA Enablement Server for Java/6.6 build SSJ-6.6-20090827-1616 and earlier allows remote attackers to inject arbitrary web script or HTML via the PATHINFO...

CVE-2016-4314

CVE-2016-4314 affects WSO2 Carbon 4.4.5. It is a Local File Inclusion vulnerability in the LogViewer Admin Service: an authenticated administrator can read arbitrary files by injecting .. into the logFile parameter of downloadgz-ajaxprocessor.jsp. Multiple references document the issue and an exp...

CVE-2016-4316

CVE-2016-4316 covers multiple XSS flaws in WSO2 Carbon 4.4.5 . The vulnerabilities allow remote attackers to inject arbitrary script/HTML via seven parameters across several JSPs: setName (identity-mgt/challenges-mgt.jsp); webappType or httpPort (webapp-list/webapp_info.jsp); dsName or descriptio...

CVE-2016-4311

CVE-2016-4311 is a CSRF vulnerability in the XACML flow feature of WSO2 Identity Server 5.1.0. The issue allows remote attackers to hijack the authentication of privileged users by crafting requests to entitlement/eval-policy-submit.jsp that process XACML requests. Public references note an in-th...

CVE-2016-4316

Multiple cross-site scripting XSS vulnerabilities in WSO2 Carbon 4.4.5 allow remote attackers to inject arbitrary web script or HTML via the 1 setName parameter to identity-mgt/challenges-mgt.jsp; the 2 webappType or 3 httpPort parameter to webapp-list/webappinfo.jsp; the 4 dsName or 5 descriptio...

CVE-2016-4314

Directory traversal vulnerability in the LogViewer Admin Service in WSO2 Carbon 4.4.5 allows remote authenticated administrators to read arbitrary files via a .. dot dot in the logFile parameter to downloadgz-ajaxprocessor.jsp...

CVE-2016-4315

CVE-2016-4315 describes a Cross-Site Request Forgery (CSRF) vulnerability in WSO2 Carbon 4.4.5 . The issue enables an attacker to hijack the authentication of privileged users and trigger a shutdown action via requests to server-admin/proxy_ajaxprocessor.jsp. Documented impact in sources: CSRF wi...

CVE-2016-4327

CVE-2016-4327 describes an XSS vulnerability in WSO2 SOA Enablement Server for Java/6.6 build SSJ-6.6-20090827-1616 and earlier. The vulnerability allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO, affecting user sessions and potentially leading to credential or dat...

CVE-2016-4315

Cross-site request forgery CSRF vulnerability in WSO2 Carbon 4.4.5 allows remote attackers to hijack the authentication of privileged users for requests that shutdown a server via a shutdown action to server-admin/proxyajaxprocessor.jsp...

CVE-2016-4312

CVE-2016-4312 affects WSO2 Identity Server 5.1.0 prior to WSO2-CARBON-PATCH-4.4.0-0231. The issue is an XML External Entity (XXE) vulnerability in the XACML flow feature that allows remote authenticated users with XACML access to read arbitrary files, cause a denial of service, perform SSRF, or i...

accounts.internal.wso2.com XSS vulnerability

Vulnerable URL:...

wso2.com XSS vulnerability

Vulnerable URL: http://wso2.com/team Details: Description| Value ---|--- Patched:| Yes, at 09.01.2017 Latest check for patch:| 09.01.2017 12:37 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 58661 VIP website status:| No Check wso2.com SSL connection:| Grade: A...

wso2.nso.ru XSS vulnerability

Vulnerable URL:...

WSO2 Carbon Products Detection (HTTP)

HTTP based detection of WSO2 Carbon products. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

WSO2 Identity Server CSRF And XXE Vulnerabilities

WSO2 Identity Server is prone to a XML external entity XXE vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

WSO2 Carbon 4.4.5 - Denial of Service Cross-Site Request Forgery

WSO2 Carbon 4.4.5 - Denial of Service Cross-Site Request Forgery + Credits: John Page aka HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/WSO2-CARBON-v4.4.5-CSRF-DOS.txt + ISR: ApparitionSec Vendor: ============ www.wso2.com Product:...

WSO2 Identity Server 5.1.0 - Multiple Vulnerabilities

WSO2 Identity Server 5.1.0 - Multiple Vulnerabilities + Credits: John Page aka HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/WSO2-IDENTITY-SERVER-v5.1.0-XML-External-Entity.txt + ISR: ApparitionSec Vendor: ============= www.wso2.com Product:...