Browse CVEs

HIGH 8.2 CVE-2023-6837 Multiple WSO2 products have been identified as vulnerable to perform user impersonatoin using JIT provisioning. In order for this vulnerability to ha… Api Manager 2.5.0.32 / 2.6.0.52+ Fix from $1,9502023-12-15 HIGH 7.5 CVE-2023-6836 Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely used featur… Api Manager after 6.6.0 Fix from $1,9502023-12-15 MEDIUM 5.3 CVE-2023-6835 Multiple WSO2 products have been identified as vulnerable due to lack of server-side input validation in the Forum feature, API rating could be manip… Api Manager Mitigation only Fix from $1,6002023-12-15 MEDIUM 6.1 CVE-2023-31664 A reflected cross-site scripting (XSS) vulnerability in /authenticationendpoint/login.do of WSO2 API Manager before 4.2.0 allows attackers to execute… Api Manager 4.2.0+ Fix from $1,6002023-05-23 MEDIUM 6.1 CVE-2022-4520 A vulnerability was found in WSO2 carbon-registry up to 4.8.11. It has been rated as problematic. Affected by this issue is some unknown functionalit… Carbon Registry 4.8.12+ Fix from $1,6002022-12-15 MEDIUM 6.1 CVE-2022-4521 A vulnerability classified as problematic has been found in WSO2 carbon-registry up to 4.8.6. This affects an unknown part of the component Request P… Carbon Registry 4.8.7+ Fix from $1,6002022-12-15 MEDIUM 6.1 CVE-2022-39809 An issue was discovered in WSO2 Enterprise Integrator 6.4.0. A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the Manageme… Enterprise Integrator Mitigation only Fix from $1,6002022-09-09 MEDIUM 6.1 CVE-2022-39810EPSS 57% An issue was discovered in WSO2 Enterprise Integrator 6.4.0. A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the Manageme… Enterprise Integrator Mitigation only Fix from $1,6002022-09-09 CRITICAL 9.1 CVE-2021-42646 XML External Entity (XXE) vulnerability in the file based service provider creation feature of the Management Console in WSO2 API Manager 2.6.0, 3.0.… Api Manager Patch available Fix from $2,3002022-05-11 MEDIUM 6.1 CVE-2022-29548EPSS 41% A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, a… Api Manager No fix yet Fix from $1,6002022-04-21 CRITICAL 9.8 CVE-2022-29464 KEVEPSS 100% Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Conten… Api Manager after 6.6.0 Fix from $2,3002022-04-18 MEDIUM 6.1 CVE-2021-36760 In accountrecoveryendpoint/recoverpassword.do in WSO2 Identity Server 5.7.0, it is possible to perform a DOM-Based XSS attack affecting the callback … Api Manager Mitigation only Fix from $1,6002021-12-07 MEDIUM 6.1 CVE-2020-17453EPSS 26% WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter. Api Manager after 6.6.0 Fix from $1,6002021-04-05 MEDIUM 6.1 CVE-2020-27885 Cross-Site Scripting (XSS) vulnerability on WSO2 API Manager 3.1.0. By exploiting a Cross-site scripting vulnerability the attacker can hijack a logg… Api Manager No fix yet Fix from $1,6002020-10-29 MEDIUM 5.4 CVE-2020-25516 WSO2 Enterprise Integrator 6.6.0 or earlier contains a stored cross-site scripting (XSS) vulnerability in BPMN explorer tasks. Enterprise Integrator after 6.6.0 Fix from $1,6002020-10-29 MEDIUM 6.1 CVE-2020-17454 WSO2 API Manager 3.1.0 and earlier has reflected XSS on the "publisher" component's admin interface. More precisely, it is possible to inject an XSS … Api Manager after 3.1.0 Fix from $1,6002020-10-21 HIGH 8.8 CVE-2020-24703 An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-controlled server if th… Api Manager after 6.6.0 Fix from $1,9502020-08-27 HIGH 8.8 CVE-2020-24705 An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-controlled server if th… Api Manager after 5.10.0 Fix from $1,9502020-08-27 MEDIUM 6.1 CVE-2020-24704 An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager 2.2.0, API Manager Analytics 2.2.0, … Api Manager after 6.6.0 Fix from $1,6002020-08-27 MEDIUM 6.1 CVE-2020-24706 An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager through 3.1.0, API Manager Analytics… Api Manager after 5.10.0 Fix from $1,6002020-08-27 CRITICAL 9.1 CVE-2020-24590 The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML Entity Expansion attacks. Api Manager after 3.1.0 Fix from $2,3002020-08-21 MEDIUM 6.5 CVE-2020-24591 The Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates. This affects API Manager through 3.0.0, API Manager … Api Manager after 5.6.0 Fix from $1,6002020-08-21 CRITICAL 9.1 CVE-2020-24589EPSS 26% The Management Console in WSO2 API Manager through 3.1.0 and API Microgateway 2.2.0 allows XML External Entity injection (XXE) attacks. Api Manager after 3.1.0 Fix from $2,3002020-08-21 MEDIUM 6.1 CVE-2020-14446 An issue was discovered in WSO2 Identity Server through 5.10.0 and WSO2 IS as Key Manager through 5.10.0. An open redirect exists. Identity Server after 5.10.0 Fix from $1,6002020-06-18 MEDIUM 5.4 CVE-2020-14444 An issue was discovered in WSO2 Identity Server through 5.9.0 and WSO2 IS as Key Manager through 5.9.0. A potential Reflected Cross-Site Scripting (X… Identity Server after 5.9.0 Fix from $1,6002020-06-18 MEDIUM 5.4 CVE-2020-14445 An issue was discovered in WSO2 Identity Server through 5.9.0 and WSO2 IS as Key Manager through 5.9.0. A potential Reflected Cross-Site Scripting (X… Identity Server after 5.9.0 Fix from $1,6002020-06-18 MEDIUM 6.7 CVE-2020-13883 In WSO2 API Manager 3.0.0 and earlier, WSO2 API Microgateway 2.2.0, and WSO2 IS as Key Manager 5.9.0 and earlier, Management Console allows XXE durin… Api Manager after 5.9.0 Fix from $1,6002020-06-06 CRITICAL 9.8 CVE-2020-13226 WSO2 API Manager 3.0.0 does not properly restrict outbound network access from a Publisher node, opening up the possibility of SSRF to this node's en… Api Manager Mitigation only Fix from $2,3002020-05-20 HIGH 7.2 CVE-2020-12719 XXE during an EventPublisher update can occur in Management Console in WSO2 API Manager 3.0.0 and earlier, API Manager Analytics 2.5.0 and earlier, A… Api Manager after 6.4.0 Fix from $1,9502020-05-08 HIGH 7.2 CVE-2020-11885 WSO2 Enterprise Integrator through 6.6.0 has an XXE vulnerability where a user (with admin console access) can use the XML validator to make unintend… Enterprise Integrator after 6.6.0 Fix from $1,9502020-04-17