4 results (0.018 seconds)

CVSS: 4.8EPSS: 0%CPEs: 35EXPL: 0

CVE-2023-6911

https://notcve.org/view.php?id=CVE-2023-6911

Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a malicious payload into the Registry feature of the Management Console. Se han identificado varios productos WSO2 como vulnerables debido a una codificación de salida incorrecta; un atacante puede llevar a cabo un ataque de Cross-Site Scripting (XSS) Almacenado inyectando un payload malicioso en la función de registro de Management Console. • https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2021/WSO2-2020-1225 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 2%CPEs: 31EXPL: 3

CVE-2022-29548 – WSO2 Management Console (Multiple Products) - Unauthenticated Reflected Cross-Site Scripting (XSS)

https://notcve.org/view.php?id=CVE-2022-29548

A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; API Manager Analytics 2.2.0, 2.5.0, and 2.6.0; API Microgateway 2.2.0; Data Analytics Server 3.2.0; Enterprise Integrator 6.2.0, 6.3.0, 6.4.0, 6.5.0, and 6.6.0; IS as Key Manager 5.5.0, 5.6.0, 5.7.0, 5.9.0, and 5.10.0; Identity Server 5.5.0, 5.6.0, 5.7.0, 5.9.0, 5.10.0, and 5.11.0; Identity Server Analytics 5.5.0 and 5.6.0; and WSO2 Micro Integrator 1.0.0. Se presenta un problema de tipo XSS reflejado en la Consola de Administración de varios productos WSO2. Esto afecta a API Manager versiones 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0 y 4.0.0; API Manager Analytics versiones 2.2.0, 2.5.0 y 2.6.0; API Microgateway versión 2.2.0; Data Analytics Server versión 3.2.0; Enterprise Integrator versiones 6.2.0, 6.3.0, 6.4. 0, 6.5.0 y 6.6.0; IS as Key Manager versiones 5.5.0, 5.6.0, 5.7.0, 5.9.0 y 5.10.0; Identity Server versiones 5.5.0, 5.6.0, 5.7.0, 5.9.0, 5.10.0 y 5.11.0; Identity Server Analytics versiones 5.5.0 y 5.6.0; y WSO2 Micro Integrator versión 1.0.0 WSO2 Management Console suffers from a cross site scripting vulnerability. Many different product versions are affected. • https://www.exploit-db.com/exploits/50970 https://github.com/cxosmo/CVE-2022-29548 http://packetstormsecurity.com/files/167587/WSO2-Management-Console-Cross-Site-Scripting.html https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2021-1603 https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2022/WSO2-2021-1603 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 8EXPL: 0

CVE-2017-14995

https://notcve.org/view.php?id=CVE-2017-14995

The Management Console in WSO2 Application Server 5.3.0, WSO2 Business Process Server 3.6.0, WSO2 Business Rules Server 2.2.0, WSO2 Complex Event Processor 4.2.0, WSO2 Dashboard Server 2.0.0, WSO2 Data Analytics Server 3.1.0, WSO2 Data Services Server 3.5.1, and WSO2 Machine Learner 1.2.0 is affected by stored XSS. La consola de administración en WSO2 Application Server 5.3.0, WSO2 Business Process Server 3.6.0, WSO2 Business Rules Server 2.2.0, WSO2 Complex Event Processor 4.2.0, WSO2 Dashboard Server 2.0.0, WSO2 Data Analytics Server 3.1.0, WSO2 Data Services Server 3.5.1 y WSO2 Machine Learner 1.2.0 se ha visto afectada por un Cross-Site Scripting (XSS) persistente. • https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2017-0257 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 4.8EPSS: 0%CPEs: 17EXPL: 2

CVE-2017-14651

https://notcve.org/view.php?id=CVE-2017-14651

WSO2 Data Analytics Server 3.1.0 has XSS in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter. WSO2 Data Analytics Server 3.1.0 tiene una vulnerabilidad de tipo Cross-Site Scripting (XSS) en carbon/resources/add_collection_ajaxprocessor.jsp mediante los parámetros collectionName o parentPath. • https://cybersecurityworks.com/zerodays/cve-2017-14651-wso2.html https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2017-0265 https://github.com/cybersecurityworks/Disclosed/issues/15 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •