CVE-2022-29464

CVE-2022-29464 WSO2 RCE CVE-2022-29464 exploit and writeup. Details CVE-2022-29464 is critical vulnerability on WSO2 discovered by Orange Tsai. the vulnerability is an unauthenticated unrestricted arbitrary file upload which allows unauthenticated attackers to gain RCE on WSO2 servers via uploadi...

WSO2RCE

WSO2RCE The CVE-2022-29464 affects some WSO2 products such as WSO2 API Manager and WSO2 Open Banking , allowing arbitrary file upload and remote code execution. Affected Products: WSO2 API Manager 2.2.0, up to 4.0.0 WSO2 Identity Server 5.2.0, up to 5.11.0 WSO2 Identity Server Analytics 5.4.0,...

WSO2 - Server Side Request Forgery

WSO2 products contain SSRF and reflected XSS vulnerabilities in the deprecated Try-It feature accessible only to administrative users, caused by improper URL validation and direct content reflection, letting attackers trick admins into executing arbitrary JavaScript and querying internal services...

WSO2 Data Analytics Server 3.1.0 - Cross-Site Scripting

WSO2 Data Analytics Server 3.1.0 is susceptible to cross-site scripting in carbon/resources/addcollectionajaxprocessor.jsp via the collectionName or parentPath parameter. id: CVE-2017-14651 info: name: WSO2 Data Analytics Server 3.1.0 - Cross-Site Scripting author: mass0ma severity: medium...

WSO2 User Registration - Arbitrary Account Creation

The SOAP admin service in WSO2 products has a security vulnerability that allows the creation of new user accounts regardless of the self-registration configuration settings. id: CVE-2024-7097 info: name: WSO2 User Registration - Arbitrary Account Creation author: iamnoooob,rootxharsh,pdresearch...

WSO2 API Manager <=3.1.0 - Blind XML External Entity Injection

WSO2 API Manager 3.1.0 and earlier is vulnerable to blind XML external entity injection XXE. XXE often allows an attacker to view files on the server file system, and to interact with any backend or external systems that the application itself can access which allows the attacker to transmit...

WSO2 - Cross-Site Scripting

WSO2 contains a reflected cross-site scripting vulnerability in the Management Console of API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; API Manager Analytics 2.2.0, 2.5.0, and 2.6.0; API Microgateway 2.2.0; Data Analytics Server 3.2.0; Enterprise Integrator 6.2.0, 6.3.0, 6.4.0,...

WSO2 Carbon Management Console <=5.10 - Cross-Site Scripting

WSO2 Management Console through 5.10 is susceptible to reflected cross-site scripting which can be exploited by tampering a request parameter in Management Console. This can be performed in both authenticated and unauthenticated requests. id: CVE-2020-17453 info: name: WSO2 Carbon Management...

carbon-identity-framework

carbon-identity-framework Branch| Build Status ---|--- master| This repository contains the core components and features required by the WSO2 Identity Server product. Building from the source If you want to build carbon-identity-framework from the source code: 1. Install Java 21. 2. Install Apach...

CVE-2020-17453-PoC

CVE-2020-17453 WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter. PoC Proof of Concept https://.com/carbon/admin/login.jsp?msgId=%27;alert1// Discoverers Name: Jackson Henry Twitter: @JacksonHHax Name: Nicholas Young...

CVE-2022-29464

CVE-2022-29464 WSO2 is a leading provider of various SOA solutions, including SOA-related infrastructure, technical frameworks, and related tools, process servers, application servers, etc. Affected Versions 2.2.0 ≤ WSO2 API Manager ≤ 4.0.0 5.2.0 ≤ WSO2 Identity Server ≤ 5.11.0 WSO2 Identity Serv...

Mass-exploit-CVE-2022-29464

Meow Meow Meow! Just a Mass Exploit based on a Python PoC for WSO2 Carbon Server CVE-2022-29464 Pre-auth RCE bug CVE-2022-29464. Meow Meow Meow? Requirements? Python3 Shodan Zoomeye A Brain What is this tool? This is a mass-autoscan-exploit of CVE-2022-29464 based on the PoC wrote in python by a...

wso2-rce-cve-2022-29464

CVE-2022-29464 WSO2 RCE CVE-2022-29464 exploit. Details CVE-2022-29464 is critical vulnerability on WSO2 discovered by Orange Tsai. the vulnerability is an unauthenticated unrestricted arbitrary file upload which which allows unauthenticated attackers to gain RCE on WSO2 servers via uploading...

CVE-2022-29464

WSO2 RCE CVE-2022-29464 exploit and writeup. Details CVE-2022-29464 is a serious flaw in WSO2. The flaw is an unauthorised, unconstrained arbitrary file upload that enables unauthorised users to upload malicious JSP files to WSO2 servers and get Remote Code Execution RCE. the vulerable upload rou...

CVE-2022-29464

WSO2 Arbitrary File Upload to Remote Command Execution RCE https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2021-1738 Example python3 exploit.py https://target.org:9443 shell.jsp...

CVE-2022-29464

CVE-2022-29464 WSO2 RCE Usage : python3 exploit.py https://host:9443/ ArbitraryShellName.jsp...

CVE-2022-29464

CVE-2022-29464 CVE-2022-29464 is a critical vulnerability in WSO2 Identity Server, an open-source identity and access management platform. The vulnerability allows remote attackers to upload malicious JSP files that can execute arbitrary commands on the target system with administrative privilege...

WSO2-2021-1258

WSO2-2021-1258: Zip Slip vulnerability in WSO2 ESB A ZIP file based directory traversal Zip Slip vulnerability was identified in the WSO2 Management Console. Remote code execution may be obtained by writing/overwriting specific files. Vendor Disclosure: The vendor's disclosure and fix for this...

WSO2-CVE-2022-29464

WSO2 Carbon Server CVE-2022-29464 Pre-auth RCE bug CVE-2022-29464. Full technical analysis will be published at my blog post: https://mr-r3bot.github.io Usage python exploit.py -u...

CVE-2022-29464

CVE-2022-29464 WSO2 RCE CVE-2022-29464 exploit and writeup. Details CVE-2022-29464 is critical vulnerability on WSO2 discovered by Orange Tsai. the vulnerability is an unauthenticated unrestricted arbitrary file upload which allows unauthenticated attackers to gain RCE on WSO2 servers via uploadi...