Linux 13140
Google 12525
Microsoft 12378
Apple 6692
Oracle 6673
Adobe 6383
Ibm 6286
Cisco 5751
Debian 3919
Mozilla 2886
Apache 2864
Redhat 2586
The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker t…
Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitati…
The Conditional Authentication (Adaptive Authentication) script does not correctly enforce the completion of all required authentication steps when a…
The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Sp…
The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for acc…
The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input. This weakness allows arbitrary unvalidated data…
The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it withi…
The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structur…
The software accepts user-supplied input via a URL parameter without adequate output encoding before reflecting it back to the user's browser. This c…
The silent Just-In-Time (JIT) provisioning feature in federated authentication implementations fails to properly segregate user roles during account …
In multi-tenanted deployments, the application consent management mechanism fails to correctly isolate consent scopes between tenants. Consent grante…
The WSO2 API Manager's message flow component, when processing WS-Addressing headers, does not sufficiently validate or restrict user-controlled inpu…
Due to not validating the organization context when executing adaptive authentication flows, the WSO2 Identity Server allows adaptive authentication …
The Magic Link authentication flow accepts multiple invalid authentication requests without adequate rate limiting or resource control, leading to un…
The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke thes…
In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowin…
Due to a lack of user account state validation during authentication, locked user accounts can be successfully authenticated using Magic Link or Pass…
The authentication endpoint accepts user-supplied input without enforcing expected validation constraints, leading to a lack of proper output encodin…
Active access tokens are not revoked or invalidated when a user account is locked within WSO2 Identity Server. This failure to enforce revocation all…
The component accepts XML input through the publisher without disabling external entity resolution. This allows malicious actors to submit a crafted …
The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection. An attacker can l…
The WSO2 API Manager developer portal accepts user-supplied input without enforcing expected validation constraints or proper output encoding. This d…
The authentication endpoint fails to adequately validate user-supplied input before reflecting it back in the response. This allows an attacker to in…
The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the resolution of external entiti…
When the "Silent Just-In-Time Provisioning" feature is enabled for a federated identity provider (IDP) there is a risk that a local user store user'…
A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST A…
Due to the use of a vulnerable third-party Velocity template engine, a malicious actor with admin privilege may inject and execute arbitrary template…
A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services in multi…
A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method for state-changing operation…
A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encoding. By t…