937 matches found
CVE-2023-6836
Multiple WSO2 products have been identified as vulnerable due to an XML External Entity XXE attack abuses a widely available but rarely used feature of XML parsers to access sensitive information...
CVE-2023-6836
CVE-2023-6836 refers to an XML External Entity (XXE) vulnerability affecting multiple WSO2 products (notably WSO2 API Manager). The underlying issue is an XML parser feature that can be abused to access sensitive information. The CVSS data in the initial document shows a high impact with network ...
CVE-2023-6835
Multiple WSO2 products have been identified as vulnerable due to lack of server-side input validation in the Forum feature, API rating could be manipulated...
CVE-2023-6835
WSO2 API Manager is identified as vulnerable due to lack of server-side input validation in the Forum feature, which could allow manipulation of API ratings. The issue is documented across multiple sources (including CVE-2023-6835 and related advisories) with no explicit exploit details provided ...
PT-2023-32785 · Wso2 · Wso2
Name of the Vulnerable Software and Affected Versions: WSO2 products affected versions not specified Description: The issue allows a malicious actor to perform user impersonation using JIT provisioning under specific conditions. These conditions include an IDP configured for federated...
WSO2 API Manager Security Vulnerability
WSO2 API Manager is a suite of API lifecycle management solutions from WSO2, USA. A security vulnerability exists in WSO2 API Manager that stems from a potential user emulation vulnerability in federated authentication using JIT configuration when certain configurations are enabled...
VulnCheck KEV: CVE-2020-17453
WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter...
CVE-2023-31664
A reflected cross-site scripting XSS vulnerability in /authenticationendpoint/login.do of WSO2 API Manager before 4.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the tenantDomain parameter...
Cross site scripting
A reflected cross-site scripting XSS vulnerability in /authenticationendpoint/login.do of WSO2 API Manager before 4.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the tenantDomain parameter...
CVE-2023-31664
A reflected cross-site scripting XSS vulnerability in /authenticationendpoint/login.do of WSO2 API Manager before 4.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the tenantDomain parameter...
CVE-2023-31664
A reflected cross-site scripting XSS vulnerability in /authenticationendpoint/login.do of WSO2 API Manager before 4.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the tenantDomain parameter...
CVE-2023-31664
The CVE-2023-31664 entry describes a reflected XSS in WSO2 API Manager prior to 4.2.0, exploitable via the tenantDomain parameter in /authenticationendpoint/login.do. Affected product is WSO2 API Manager; root cause is improper escaping/output handling of user-controlled input in tenantDomain, en...
CVE-2023-31664
A reflected cross-site scripting XSS vulnerability in /authenticationendpoint/login.do of WSO2 API Manager before 4.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the tenantDomain parameter...
Jenkins WSO2 Oauth Plugin Session Fixation vulnerability
Jenkins WSO2 Oauth Plugin 1.0 and earlier does not invalidate the existing session on login. This allows attackers to use social engineering techniques to gain administrator access to Jenkins. As of publication of this advisory, there is no fix...
GHSA-7XGJ-J9HP-C692 Jenkins WSO2 Oauth Plugin cross-site request forgery vulnerability
Jenkins WSO2 Oauth Plugin 1.0 and earlier does not implement a state parameter in its OAuth flow, a unique and non-guessable value associated with each authentication request. This vulnerability allows attackers to trick users into logging in to the attacker’s account. As of publication of this...
Jenkins WSO2 Oauth Plugin cross-site request forgery vulnerability
Jenkins WSO2 Oauth Plugin 1.0 and earlier does not implement a state parameter in its OAuth flow, a unique and non-guessable value associated with each authentication request. This vulnerability allows attackers to trick users into logging in to the attacker’s account. As of publication of this...
GHSA-XXQ2-74HW-VG6M Jenkins WSO2 Oauth Plugin Session Fixation vulnerability
Jenkins WSO2 Oauth Plugin 1.0 and earlier does not invalidate the existing session on login. This allows attackers to use social engineering techniques to gain administrator access to Jenkins. As of publication of this advisory, there is no fix...
CVE-2023-33005
Jenkins WSO2 Oauth Plugin 1.0 and earlier does not invalidate the previous session on login...