CVSS: 6.5EPSS: 0%CPEs: 7EXPL: 0CVE-2020-24591
https://notcve.org/view.php?id=CVE-2020-24591
The Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates. This affects API Manager through 3.0.0, API Manager Analytics 2.2.0 and 2.5.0, API Microgateway 2.2.0, Enterprise Integrator 6.2.0 and 6.3.0, and Identity Server Analytics through 5.6.0. La Consola de Administración en determinados productos WSO2, permite ataques de tipo XXE durante las actualizaciones de EventReceiver. Esto afecta a la API Manager versiones hasta 3.0.0, la API Manager Analytics versiones 2.2.0 y 2.5.0, la API Microgateway versión 2.2.0, Enterprise Integrator versiones 6.2.0 y 6.3.0 e Identity Server Analytics versiones hasta 5.6.0. • https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0728 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 8.7EPSS: 0%CPEs: 7EXPL: 0CVE-2020-12719
https://notcve.org/view.php?id=CVE-2020-12719
XXE during an EventPublisher update can occur in Management Console in WSO2 API Manager 3.0.0 and earlier, API Manager Analytics 2.5.0 and earlier, API Microgateway 2.2.0, Enterprise Integrator 6.4.0 and earlier, IS as Key Manager 5.9.0 and earlier, Identity Server 5.9.0 and earlier, and Identity Server Analytics 5.6.0 and earlier. Una vulnerabilidad de tipo XXE durante una actualización de EventPublisher puede presentarse en Management Console en WSO2 API Manager versiones 3.0.0 y anteriores, API Manager Analytics versiones 2.5.0 y anteriores, API Microgateway versión 2.2.0, Enterprise Integrator versiones 6.4.0 y anteriores, IS as Key Manager versiones 5.9.0 y anteriores, Identity Server versiones 5.9.0 y anteriores, e Identity Server Analytics versiones 5.6.0 y anteriores. • https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2019-0665 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2020-11885
https://notcve.org/view.php?id=CVE-2020-11885
WSO2 Enterprise Integrator through 6.6.0 has an XXE vulnerability where a user (with admin console access) can use the XML validator to make unintended network invocations such as SSRF via an uploaded file. WSO2 Enterprise Integrator versiones hasta 6.6.0, tiene una vulnerabilidad de tipo XXE en la que un usuario (con acceso a la consola de administración) puede usar el validador XML para hacer invocaciones de red no intencionadas tales como SSRF por medio de un archivo cargado. • https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0684 • CWE-611: Improper Restriction of XML External Entity Reference CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 4.8EPSS: 0%CPEs: 4EXPL: 1CVE-2019-20442
https://notcve.org/view.php?id=CVE-2019-20442
An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. A potential stored Cross-Site Scripting (XSS) vulnerability in roleToAuthorize has been identified in the registry UI. Se detectó un problema en WSO2 API Manager versión 2.6.0, WSO2 Enterprise Integrator versión 6.5.0, WSO2 IS as Key Manager versión 5.7.0 y WSO2 Identity Server versión 5.8.0. Se identificó una potencial vulnerabilidad de tipo Cross-Site Scripting (XSS) Almacenado en roleToAuthorize en la Interfaz de Usuario de registro. • https://cybersecurityworks.com/zerodays/cve-2019-20442-wso2.html https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2019-0636 https://github.com/cybersecurityworks/Disclosed/issues/25 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 4EXPL: 2CVE-2019-20443
https://notcve.org/view.php?id=CVE-2019-20443
An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. A potential stored Cross-Site Scripting (XSS) vulnerability in mediaType has been identified in the registry UI. Se detectó un problema en WSO2 API Manager versión 2.6.0, WSO2 Enterprise Integrator versión 6.5.0, WSO2 IS as Key Manager versión 5.7.0 y WSO2 Identity Server versión 5.8.0. Se identificó una potencial vulnerabilidad de tipo Cross-Site Scripting (XSS) Almacenado en mediaType en la Interfaz de Usuario de registro. • https://cybersecurityworks.com/zerodays/cve-2019-20443-wso2.html https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2019-0636 https://github.com/cybersecurityworks/Disclosed/issues/26 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •