Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
Wso2Identity Server*

10 matches found

CVE
CVE•added 2022/04/18 10:15 p.m.•1754 views

CVE-2022-29464

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directo...

10CVSS9.6AI score0.94434EPSS
CVE
CVE•added 2020/05/08 12:15 a.m.•79 views

CVE-2020-12719

XXE during an EventPublisher update can occur in Management Console in WSO2 API Manager 3.0.0 and earlier, API Manager Analytics 2.5.0 and earlier, API Microgateway 2.2.0, Enterprise Integrator 6.4.0 and earlier, IS as Key Manager 5.9.0 and earlier, Identity Server 5.9.0 and earlier, and Identity S...

8.7CVSS6.9AI score0.00403EPSS
CVE
CVE•added 2021/04/05 10:15 p.m.•58 views

CVE-2020-17453

WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter.

6.1CVSS5.9AI score0.76253EPSS
CVE
CVE•added 2023/12/15 10:15 a.m.•54 views

CVE-2023-6837

Multiple WSO2 products have been identified as vulnerable to perform user impersonatoin using JIT provisioning. In order for this vulnerability to have any impact on your deployment, following conditions must be met: An IDP configured for federated authentication and JIT provisioning enabled with t...

8.5CVSS8.4AI score0.00316EPSS
CVE
CVE•added 2018/04/25 8:29 p.m.•46 views

CVE-2018-8716

WSO2 Identity Server before 5.5.0 has XSS via the dashboard, allowing attacks by low-privileged attackers.

5.4CVSS5.1AI score0.01066EPSS
CVE
CVE•added 2020/08/27 4:15 p.m.•38 views

CVE-2020-24705

An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-controlled server if the victim submits a crafted Try It request, aka Session Hijacking. This affects API Manager through 3.1.0, API Manager Analytics 2.5.0, IS as Key Manag...

8.8CVSS8.4AI score0.00397EPSS
CVE
CVE•added 2020/08/27 4:15 p.m.•34 views

CVE-2020-24706

An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager through 3.1.0, API Manager Analytics 2.5.0, IS as Key Manager through 5.10.0, Identity Server through 5.10.0, Identity Server Analytics through 5.6.0, and IoT Server 3.1.0.

6.1CVSS6.2AI score0.00603EPSS
CVE
CVE•added 2020/06/18 6:15 p.m.•31 views

CVE-2020-14446

An issue was discovered in WSO2 Identity Server through 5.10.0 and WSO2 IS as Key Manager through 5.10.0. An open redirect exists.

6.1CVSS6.2AI score0.00147EPSS
CVE
CVE•added 2020/06/18 6:15 p.m.•30 views

CVE-2020-14444

An issue was discovered in WSO2 Identity Server through 5.9.0 and WSO2 IS as Key Manager through 5.9.0. A potential Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the Management Console Policy Administration user interface.

5.4CVSS5.2AI score0.00217EPSS
CVE
CVE•added 2020/06/18 6:15 p.m.•28 views

CVE-2020-14445

An issue was discovered in WSO2 Identity Server through 5.9.0 and WSO2 IS as Key Manager through 5.9.0. A potential Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the Management Console Basic Policy Editor user Interface.

5.4CVSS5.2AI score0.00217EPSS