WSO2 Carbon 4.4.5 - Local File Inclusion

WSO2 Carbon 4.4.5 - Local File Inclusion + Credits: John Page aka HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/WSO2-CARBON-v4.4.5-LOCAL-FILE-INCLUSION.txt + ISR: ApparitionSec Vendor: =============== www.wso2.com Product: ====================...

WSO2 Carbon 4.4.5 - Denial of Service / Cross-Site Request Forgery

Exploit for jsp platform in category web applications + Credits: John Page aka HYP3RLINX Vendor: ============ www.wso2.com Product: ================== Ws02Carbon v4.4.5 WSO2 Carbon is the core platform on which WSO2 middleware products are built. It is based on Java OSGi technology, which allows...

WSO2 Carbon 4.4.5 - Local File Inclusion

Exploit for jsp platform in category web applications + Credits: John Page aka HYP3RLINX Vendor: =============== www.wso2.com Product: ==================== Ws02Carbon v4.4.5 WSO2 Carbon is the core platform on which WSO2 middleware products are built. It is based on Java OSGi technology, which...

WSO2 Identity Server 5.1.0 - Multiple Vulnerabilities

Exploit for jsp platform in category web applications + Credits: John Page aka HYP3RLINX Vendor: ============= www.wso2.com Product: ============================ Wso2 Identity Server v5.1.0 As the industry’s first enterprise identity bus EIB, WSO2 Identity Server is the central backbone that...

WSO2 Identity Server 5.1.0 - Multiple Vulnerabilities

Credits: John Page aka HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/WSO2-IDENTITY-SERVER-v5.1.0-XML-External-Entity.txt + ISR: ApparitionSec Vendor: ============= www.wso2.com Product: ============================ Wso2 Identity Server v5.1.0...

WSO2 Carbon 4.4.5 Cross Site Scripting

Credits: John Page aka HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/WSO2-CARBON-v4.4.5-PERSISTENT-XSS-COOKIE-THEFT.txt + ISR: ApparitionSec Vendor: ============= www.wso2.com Product: ================== Ws02Carbon v4.4.5 WSO2 Carbon is the...

WSO2 Carbon 4.4.5 Cross Site Request Forgery / Denial Of Service

Credits: John Page aka HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/WSO2-CARBON-v4.4.5-CSRF-DOS.txt + ISR: ApparitionSec Vendor: ============ www.wso2.com Product: ================== Ws02Carbon v4.4.5 WSO2 Carbon is the core platform on which...

WSO2 Identity Server 5.1.0 XML Injection

Credits: John Page aka HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/WSO2-IDENTITY-SERVER-v5.1.0-XML-External-Entity.txt + ISR: ApparitionSec Vendor: ============= www.wso2.com Product: ============================ Wso2 Identity Server v5.1.0...

WSO2 Carbon 4.4.5 Local File Inclusion

Credits: John Page aka HYP3RLINX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/WSO2-CARBON-v4.4.5-LOCAL-FILE-INCLUSION.txt + ISR: ApparitionSec Vendor: =============== www.wso2.com Product: ==================== Ws02Carbon v4.4.5 WSO2 Carbon is the core...

WSO2 SOA Enablement Server XML External Entity Injection

Title: WSO2 SOA Enablement Server - XML External Entity Injection Authors: Pawel Gocyla, Jakub Palaczynski Date: 08. June 2016 Affected Software: ================== WSO2 SOA Enablement Server for Java/6.6 build SSJ-6.6-20090827-1616 Probably other versions are also vulnerable. Vulnerability: XML...

WSO2 SOA Enablement Server Server Side Request Forgery

Title: WSO2 SOA Enablement Server - Server Side Request Forgery Authors: Pawel Gocyla Date: 10. June 2016 Affected Software: ================== WSO2 SOA Enablement Server for Java/6.6 build SSJ-6.6-20090827-1616 Probably other versions are also vulnerable. Vulnerability: Server Side Request Forge...

WSO2 SOA Enablement Server Cross Site Scripting

Title: WSO2 SOA Enablement Server - Reflected Cross Site Scripting Authors: Pawel Gocyla Date: 08. June 2016 Affected Software: ================== WSO2 SOA Enablement Server for Java/6.6 build SSJ-6.6-20090827-1616 Probably other versions are also vulnerable. Vulnerability: Reflected Cross Site...

WSO2 SOA Enablement Server Detection (HTTP)

Detection of installed version of WSO2 SOA Enablement Server. This script check the presence of WSO2 SOA Enablement Server from the banner. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right...

WSO2 SOA Enablement Server <= SSJ-6.6-20090827-1616 Reflected XSS Vulnerability

WSO2 SOA Enablement Server is prone to a reflected cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE ...

WSO2 SOA Enablement Server Cross Site Scripting

Title: WSO2 SOA Enablement Server - Reflected Cross-Site Scripting Authors: Jakub Pałaczyński, Łukasz Juszczyk Date: 08. April 2016 Affected Software: ============= WSO2 SOA Enablement Server for Java/6.6 build SSJ-6.6-20090827-1616 Probably other versions are also vulnerable. Proof of Concept:...

WSO2 Identity Server Cross-Site Scripting Vulnerability

WSO2 Identity Server is an open source identity service that supports Information Cards, OpenID and XACML identity frameworks. WSO2 Identity Server suffers from a cross-site scripting vulnerability that allows remote attackers to exploit the vulnerability to inject malicious script or HTML code,...

SEC Consult SA-20150513-0 :: Multiple critical vulnerabilities in WSO2 Identity Server

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory 20150513-0 ======================================================================= title: Multiple critical vulnerabilities product: WSO2 Identity Server other WSO2 Carbon based products may be affected...

XSS, CSRF Vulnerabilities identitified in WSO2 Identity Server

A handful of vulnerabilities have been identified in WSO2 Identity Server that could lead to takeover, firewall bypass, and potentially expose subsequent internal servers to further attacks. The open source server software helps developers manage identities and keep track of web apps, services an...

WSO2 Identity Server 5.0.0 XSS / CSRF / XXE Injection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple critical vulnerabilities product: WSO2 Identity Server other WSO2 Carbon based products may be affected too...

WSO2 Identity Server multiple vulnerabilities

Hi, WSO2 Identity Server http://wso2.com/products/identity-server/ version 4.5.0/4.6.0/5.0.0 is prone to multiple vulnerabilities, including authentication bypass. Timeline: 09.10.2014 - Vendor notified 22.11.2014 - Vendor confirmed 04.12.2014 - Patches released 25.03.2015 - Bugtraq disclosure...