CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-13226
https://notcve.org/view.php?id=CVE-2020-13226
WSO2 API Manager 3.0.0 does not properly restrict outbound network access from a Publisher node, opening up the possibility of SSRF to this node's entire intranet. El WSO2 API Manager versión 3.0.0, no restringe apropiadamente el acceso de red fuera del límite de un nodo Publisher, abriendo la posibilidad de un ataque de tipo SSRF a toda la intranet de este nodo. • https://docs.wso2.com/display/Security/Security+Advisories https://docs.wso2.com/display/Security/WSO2+Security+Vulnerability+Management+Process https://github.com/wso2/docs-apim/issues/816 https://github.com/wso2/product-apim/issues/7677 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 8.7EPSS: 0%CPEs: 7EXPL: 0CVE-2020-12719
https://notcve.org/view.php?id=CVE-2020-12719
XXE during an EventPublisher update can occur in Management Console in WSO2 API Manager 3.0.0 and earlier, API Manager Analytics 2.5.0 and earlier, API Microgateway 2.2.0, Enterprise Integrator 6.4.0 and earlier, IS as Key Manager 5.9.0 and earlier, Identity Server 5.9.0 and earlier, and Identity Server Analytics 5.6.0 and earlier. Una vulnerabilidad de tipo XXE durante una actualización de EventPublisher puede presentarse en Management Console en WSO2 API Manager versiones 3.0.0 y anteriores, API Manager Analytics versiones 2.5.0 y anteriores, API Microgateway versión 2.2.0, Enterprise Integrator versiones 6.4.0 y anteriores, IS as Key Manager versiones 5.9.0 y anteriores, Identity Server versiones 5.9.0 y anteriores, e Identity Server Analytics versiones 5.6.0 y anteriores. • https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2019-0665 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2020-11885
https://notcve.org/view.php?id=CVE-2020-11885
WSO2 Enterprise Integrator through 6.6.0 has an XXE vulnerability where a user (with admin console access) can use the XML validator to make unintended network invocations such as SSRF via an uploaded file. WSO2 Enterprise Integrator versiones hasta 6.6.0, tiene una vulnerabilidad de tipo XXE en la que un usuario (con acceso a la consola de administración) puede usar el validador XML para hacer invocaciones de red no intencionadas tales como SSRF por medio de un archivo cargado. • https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0684 • CWE-611: Improper Restriction of XML External Entity Reference CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-10797
https://notcve.org/view.php?id=CVE-2019-10797
Netty in WSO2 transport-http before v6.3.1 is vulnerable to HTTP Response Splitting due to HTTP Header validation being disabled. Netty en WSO2 transport-http versiones anteriores a v6.3.1, es vulnerable a HTTP Response Splitting debido a que una comprobación de Encabezado HTTP es deshabilitada. • https://snyk.io/vuln/SNYK-JAVA-ORGWSO2TRANSPORTHTTP-548944 •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 2CVE-2019-20434
https://notcve.org/view.php?id=CVE-2019-20434
An issue was discovered in WSO2 API Manager 2.6.0. A potential Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the Datasource creation page of the Management Console. Se detectó un problema en WSO2 API Manager versión 2.6.0. Se ha identificado una potencial vulnerabilidad de tipo Cross-Site Scripting (XSS) Reflejado en la página Datasource creation de la Consola de Administración. • https://cybersecurityworks.com/zerodays/cve-2019-20434-wso2.html https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2019-0616 https://github.com/cybersecurityworks/Disclosed/issues/17 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •