CVSS: 6.1EPSS: 76%CPEs: 17EXPL: 4CVE-2020-17453
https://notcve.org/view.php?id=CVE-2020-17453
05 Apr 2021 — WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter. WSO2 Management Console versiones hasta 5.10, permite un ataque de tipo XSS por medio del parámetro msgId en el archivo carbon/admin/login.jsp • https://github.com/karthi-the-hacker/CVE-2020-17453 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 6EXPL: 0CVE-2020-24705
https://notcve.org/view.php?id=CVE-2020-24705
27 Aug 2020 — An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-controlled server if the victim submits a crafted Try It request, aka Session Hijacking. This affects API Manager through 3.1.0, API Manager Analytics 2.5.0, IS as Key Manager through 5.10.0, Identity Server through 5.10.0, Identity Server Analytics through 5.6.0, and IoT Server 3.1.0. Se detectó un problema en determinados productos WSO2. Se puede enviar una cookie de sesión válida ... • https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/2020/WSO2-2020-0718 •
CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0CVE-2020-24706
https://notcve.org/view.php?id=CVE-2020-24706
27 Aug 2020 — An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager through 3.1.0, API Manager Analytics 2.5.0, IS as Key Manager through 5.10.0, Identity Server through 5.10.0, Identity Server Analytics through 5.6.0, and IoT Server 3.1.0. Se detectó un problema en determinados productos WSO2. La herramienta Try It permite un ataque de tipo XSS Reflejado. • https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2020-0718 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 1CVE-2020-14444
https://notcve.org/view.php?id=CVE-2020-14444
18 Jun 2020 — An issue was discovered in WSO2 Identity Server through 5.9.0 and WSO2 IS as Key Manager through 5.9.0. A potential Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the Management Console Policy Administration user interface. Se detectó un problema en WSO2 Identity Server versiones hasta 5.9.0 y WSO2 IS como Key Manager versiones hasta 5.9.0. Se identificó una potencial vulnerabilidad de tipo Cross-Site Scripting (XSS) Reflejado en la interfaz de usuario Management Console Policy Ad... • https://cybersecurityworks.com/zerodays/cve-2020-14444-wso2.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 1CVE-2020-14445
https://notcve.org/view.php?id=CVE-2020-14445
18 Jun 2020 — An issue was discovered in WSO2 Identity Server through 5.9.0 and WSO2 IS as Key Manager through 5.9.0. A potential Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the Management Console Basic Policy Editor user Interface. Se detectó un problema en WSO2 Identity Server versiones hasta 5.9.0 y WSO2 IS como Key Manager versiones hasta 5.9.0. Se ha identificado una potencial vulnerabilidad de tipo Cross-Site Scripting (XSS) Reflejado en la interfaz de usuario Management Console Basic ... • https://cybersecurityworks.com/zerodays/cve-2020-14445-wso2.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 1CVE-2020-14446
https://notcve.org/view.php?id=CVE-2020-14446
18 Jun 2020 — An issue was discovered in WSO2 Identity Server through 5.10.0 and WSO2 IS as Key Manager through 5.10.0. An open redirect exists. Se detectó un problema en WSO2 Identity Server versiones hasta 5.10.0 y WSO2 IS como Key Manager versiones hasta 5.10.0. Se presenta un redireccionamiento abierto • https://cybersecurityworks.com/zerodays/cve-2020-14446-wso2.html • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 8.7EPSS: 0%CPEs: 7EXPL: 0CVE-2020-12719
https://notcve.org/view.php?id=CVE-2020-12719
07 May 2020 — XXE during an EventPublisher update can occur in Management Console in WSO2 API Manager 3.0.0 and earlier, API Manager Analytics 2.5.0 and earlier, API Microgateway 2.2.0, Enterprise Integrator 6.4.0 and earlier, IS as Key Manager 5.9.0 and earlier, Identity Server 5.9.0 and earlier, and Identity Server Analytics 5.6.0 and earlier. Una vulnerabilidad de tipo XXE durante una actualización de EventPublisher puede presentarse en Management Console en WSO2 API Manager versiones 3.0.0 y anteriores, API Manager A... • https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2019-0665 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 5.4EPSS: 1%CPEs: 1EXPL: 6CVE-2018-8716 – WSO2 Carbon / WSO2 Dashboard Server 5.3.0 - Persistent Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2018-8716
24 Apr 2018 — WSO2 Identity Server before 5.5.0 has XSS via the dashboard, allowing attacks by low-privileged attackers. WSO2 Identity Server, en versiones anteriores a la 5.5.0, tiene Cross-Site Scripting (XSS) mediante el dashboard, lo que permite ataques por parte de atacantes con pocos privilegios. WSO2 Identity Sever version 5.3.0 suffers from multiple persistent cross site scripting vulnerabilities. • https://packetstorm.news/files/id/147330 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 4CVE-2016-4311 – WSO2 Identity Server 5.1.0 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2016-4311
13 Aug 2016 — Cross-site request forgery (CSRF) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 allows remote attackers to hijack the authentication of privileged users for requests that process XACML requests via an entitlement/eval-policy-submit.jsp request. Vulnerabilidad de CSRF en la funcionalidad de flujo XACML en WSO2 Identity Server 5.1.0 permite a atacantes remotos secuestrar la autenticación de usuarios privilegiados para solicitudes que procesan solicitudes XACML a través de una solicitud... • https://packetstorm.news/files/id/138329 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.5EPSS: 5%CPEs: 1EXPL: 4CVE-2016-4312 – WSO2 Identity Server 5.1.0 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2016-4312
13 Aug 2016 — XML external entity (XXE) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 before WSO2-CARBON-PATCH-4.4.0-0231 allows remote authenticated users with access to XACML features to read arbitrary files, cause a denial of service, conduct server-side request forgery (SSRF) attacks, or have unspecified other impact via a crafted XACML request to entitlement/eval-policy-submit.jsp. NOTE: this issue can be combined with CVE-2016-4311 to exploit the vulnerability without credentials. Vulnerabil... • https://packetstorm.news/files/id/138329 • CWE-611: Improper Restriction of XML External Entity Reference •