358 matches found
PT-2019-13988 · Wso2 · Wso2 Api Manager
Name of the Vulnerable Software and Affected Versions: WSO2 API Manager versions 2.6.0 through the version before WSO2-CARBON-PATCH-4.4.0-4457 Description: The issue is related to a crafted filename that can cause XSS via the file-upload feature of the event simulator component. Recommendations:...
CVE-2019-6513
An issue was discovered in WSO2 API Manager 2.6.0. It is possible for a logged-in user to upload, as API documentation, any type of file by changing the extension to an allowed one...
CVE-2019-6513
An issue was discovered in WSO2 API Manager 2.6.0. It is possible for a logged-in user to upload, as API documentation, any type of file by changing the extension to an allowed one...
Design/Logic Flaw
An issue was discovered in WSO2 API Manager 2.6.0. It is possible for a logged-in user to upload, as API documentation, any type of file by changing the extension to an allowed one...
CVE-2019-6513
WSO2 API Manager 2.6.0 is affected by CVE-2019-6513: a logged-in user can upload, as API documentation, any type of file by changing its extension to an allowed one. This vulnerability is described across multiple sources (NVD, OSV, CVE records) with the same root issue. No explicit exploits, mit...
CVE-2019-6513
An issue was discovered in WSO2 API Manager 2.6.0. It is possible for a logged-in user to upload, as API documentation, any type of file by changing the extension to an allowed one...
Code injection
An issue was discovered in WSO2 API Manager 2.6.0. Uploaded documents for API documentation are available to an unauthenticated user...
CVE-2019-6512
An issue was discovered in WSO2 API Manager 2.6.0. It is possible to force the application to perform requests to the internal workstation SSRF port-scanning, other adjacent workstations SSRF network scanning, or to enumerate files because of the existence of the file:// wrapper...
CVE-2019-6512
An issue was discovered in WSO2 API Manager 2.6.0. It is possible to force the application to perform requests to the internal workstation SSRF port-scanning, other adjacent workstations SSRF network scanning, or to enumerate files because of the existence of the file:// wrapper...
CVE-2019-6515
An issue was discovered in WSO2 API Manager 2.6.0. Uploaded documents for API documentation are available to an unauthenticated user...
Code injection
An issue was discovered in WSO2 API Manager 2.6.0. It is possible to force the application to perform requests to the internal workstation SSRF port-scanning, other adjacent workstations SSRF network scanning, or to enumerate files because of the existence of the file:// wrapper...
CVE-2019-6515
An issue was discovered in WSO2 API Manager 2.6.0. Uploaded documents for API documentation are available to an unauthenticated user...
CVE-2019-6515
Technical details (affected products, components, impact, remediation) are not publicly available in the provided documents. Monitor for updates.
CVE-2019-6515
An issue was discovered in WSO2 API Manager 2.6.0. Uploaded documents for API documentation are available to an unauthenticated user...
CVE-2019-6512
An issue was discovered in WSO2 API Manager 2.6.0. It is possible to force the application to perform requests to the internal workstation SSRF port-scanning, other adjacent workstations SSRF network scanning, or to enumerate files because of the existence of the file:// wrapper...
CVE-2019-6512
WSO2 API Manager 2.6.0 is affected by an SSRF issue that can force the application to access internal resources via the file:// wrapper, enabling requests to internal/workstation hosts (port-scanning), neighboring systems (network scanning), or file enumeration. The root cause is the presence of ...
CVE-2018-20737
An issue was discovered in WSO2 API Manager 2.1.0 and 2.6.0. Reflected XSS exists in the carbon part of the product...
CVE-2018-20737
An issue was discovered in WSO2 API Manager 2.1.0 and 2.6.0. Reflected XSS exists in the carbon part of the product...