CVE-2017-14651

Summary: CVE-2017-14651 affects WSO2 Data Analytics Server 3.1.0. The vulnerability is a cross-site scripting (XSS) flaw in carbon/resources/add_collection_ajaxprocessor.jsp, exploitable via the collectionName or parentPath parameters. Exploitation could cause injected scripts to run in a victim’...

CVE-2023-6835

WSO2 API Manager is identified as vulnerable due to lack of server-side input validation in the Forum feature, which could allow manipulation of API ratings. The issue is documented across multiple sources (including CVE-2023-6835 and related advisories) with no explicit exploit details provided ...

CVE-2020-24703

CVE-2020-24703 affects multiple WSO2 products: API Manager 2.2.0, API Manager Analytics 2.2.0, API Microgateway 2.2.0, Data Analytics Server 3.2.0, Enterprise Integrator through 6.6.0, IS as Key Manager 5.5.0, Identity Server 5.5.0 and 5.8.0, Identity Server Analytics 5.5.0, and IoT Server 3.3.0–...

CVE-2020-24705

CVE-2020-24705 describes a session hijacking vulnerability in several WSO2 products where a valid Carbon Management Console session cookie can be sent to an attacker-controlled server after a crafted Try It request. Affected are WSO2 API Manager (through 3.1.0), API Manager Analytics (2.5.0), IS ...

CVE-2021-36760

WSO2 Identity Server 5.7.0 contains a DOM-Based XSS in accountrecoveryendpoint/recoverpassword.do that manipulates the callback parameter in the URL before the callback is invoked. This can lead to execution of injected JavaScript after the username/password reset flow completes. The same endpoin...

CVE-2020-24706

WSO2 advisory CVE-2020-24706 affects API Manager (through 3.1.0), API Manager Analytics (2.5.0), IS as Key Manager (through 5.10.0), Identity Server (through 5.10.0), Identity Server Analytics (through 5.6.0), and IoT Server (3.1.0). Root cause: Try It tool allows Reflected XSS. Impact: potential...

CVE-2020-24704

CVE-2020-24704 is a reflected XSS vulnerability affecting multiple WSO2 products (API Manager, API Manager Analytics, API Microgateway, Data Analytics Server, Enterprise Integrator, IS as Key Manager, Identity Server/Analytics, and IoT Server) with versions listed in the Initial description. The ...