Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Perimeter Scanner
Scanning
Projects
Scanner
Agent Scanning
API Scanning
Manual Audit
Email
Webhook
Resources
Documents
Blog
Glossary
FAQ
Plugins
Pricing
Contacts
About Us
Partners
Branding Guideline
Settings
Sign in
Wso2Identity Server

11 matches found

CVE
CVE•added 2022/04/21 2:15 a.m.•710 views

CVE-2022-29548

A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; API Manager Analytics 2.2.0, 2.5.0, and 2.6.0; API Microgateway 2.2.0; Data Analytics Server 3.2.0; Enterprise Integrator 6.2.0, 6.3.0, 6.4....

6.1CVSS5.8AI score0.79277EPSS
CVE
CVE•added 2020/01/28 1:15 a.m.•61 views

CVE-2019-20436

An issue was discovered in WSO2 API Manager 2.6.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. If there is a claim dialect configured with an XSS payload in the dialect URI, and a user picks up this dialect's URI and adds it as the service provider claim dialect while configuring ...

6.1CVSS5.9AI score0.00892EPSS
CVE
CVE•added 2020/01/28 1:15 a.m.•60 views

CVE-2019-20437

An issue was discovered in WSO2 API Manager 2.6.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. When a custom claim dialect with an XSS payload is configured in the identity provider basic claim configuration, that payload gets executed, if a user picks up that dialect's URI as the...

6.1CVSS5.9AI score0.01101EPSS
CVE
CVE•added 2021/04/05 10:15 p.m.•58 views

CVE-2020-17453

WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter.

6.1CVSS5.9AI score0.76253EPSS
CVE
CVE•added 2019/11/12 3:15 a.m.•39 views

CVE-2019-18882

WSO2 IS as Key Manager 5.7.0 allows stored XSS in download-userinfo.jag because Content-Type is mishandled.

6.1CVSS5.9AI score0.00421EPSS
CVE
CVE•added 2021/12/07 9:15 p.m.•35 views

CVE-2021-36760

In accountrecoveryendpoint/recoverpassword.do in WSO2 Identity Server 5.7.0, it is possible to perform a DOM-Based XSS attack affecting the callback parameter modifying the URL that precedes the callback parameter. Once the username or password reset procedure is completed, the JavaScript code will...

6.1CVSS6.1AI score0.01277EPSS
CVE
CVE•added 2020/08/27 4:15 p.m.•34 views

CVE-2020-24704

An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager 2.2.0, API Manager Analytics 2.2.0, API Microgateway 2.2.0, Data Analytics Server 3.2.0, Enterprise Integrator through 6.6.0, IS as Key Manager 5.5.0, Identity Server 5.5.0 and 5.8.0, Id...

6.1CVSS6.2AI score0.00187EPSS
CVE
CVE•added 2020/08/27 4:15 p.m.•34 views

CVE-2020-24706

An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager through 3.1.0, API Manager Analytics 2.5.0, IS as Key Manager through 5.10.0, Identity Server through 5.10.0, Identity Server Analytics through 5.6.0, and IoT Server 3.1.0.

6.1CVSS6.2AI score0.00603EPSS
CVE
CVE•added 2019/11/12 3:15 a.m.•31 views

CVE-2019-18881

WSO2 IS as Key Manager 5.7.0 allows unauthenticated reflected XSS in the dashboard user profile.

6.1CVSS6AI score0.00422EPSS
CVE
CVE•added 2020/06/18 6:15 p.m.•31 views

CVE-2020-14446

An issue was discovered in WSO2 Identity Server through 5.10.0 and WSO2 IS as Key Manager through 5.10.0. An open redirect exists.

6.1CVSS6.2AI score0.00147EPSS
CVE
CVE•added 2023/12/15 10:15 a.m.•31 views

CVE-2023-6838

Reflected XSS vulnerability can be exploited by tampering a request parameter in Authentication Endpoint. This can be performed in both authenticated and unauthenticated requests.

6.1CVSS6AI score0.00593EPSS