identity server as key manager · threatengine.sh

Home/Product/wso2 identity server as key manager

Product

wso2 identity server as key manager

41 known vulnerabilities across versions

Vulnerabilities are listed by affected version. Select any CVE for the full briefing and its intelligence graph.

Sort Min CVSS Published since

>= 5.10.0 and < 5.10.0.296

The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the resolution

A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOA

A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method for state

A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper ou

An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and des

An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper input validation in the CarbonAppUploader

An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access t

SSRF and Reflected XSS Vulnerabilities exist in multiple WSO2 products within the deprecated Try-It feature, which was accessible

An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain in

Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certai

An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user-supplied filenames in t

A username enumeration vulnerability exists in multiple WSO2 products when Multi-Attribute Login is enabled. In this configuration

An authentication bypass vulnerability exists in multiple WSO2 products when FIDO authentication is enabled. When a user account i

A cross-tenant authentication vulnerability exists in multiple WSO2 products due to improper cryptographic design in Adaptive Auth

An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files store

A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error

A server-side request forgery (SSRF) vulnerability exists in multiple WSO2 products due to improper input validation in SOAP admin

A stored cross-site scripting (XSS) vulnerability exists in the Management Console of multiple WSO2 products due to insufficient i

An open redirection vulnerability exists in multiple WSO2 products due to improper validation of the multi-option URL in the authe

An incorrect authorization vulnerability exists in multiple WSO2 products due to a flaw in the SOAP admin service, which allows us

A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services. A malic

An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account recovery-rel

Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) att

Reflected XSS vulnerability can be exploited by tampering a request parameter in Authentication Endpoint. This can be performed in

>= 5.6.0 and < 5.6.0.17

Multiple WSO2 products have been identified as vulnerable to perform user impersonatoin using JIT provisioning. In order for this

Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but

XML External Entity (XXE) vulnerability in the file based service provider creation feature of the Management Console in WSO2 API

A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0, 2.6.0, 3.0

>= 5.3.0 and <= 5.10.0

Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload end

In accountrecoveryendpoint/recoverpassword.do in WSO2 Identity Server 5.7.0, it is possible to perform a DOM-Based XSS attack affe

WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter.

An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager through 3.1.0, AP

An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-cont

An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager 2.2.0, API Manage

An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-cont

An issue was discovered in WSO2 Identity Server through 5.10.0 and WSO2 IS as Key Manager through 5.10.0. An open redirect exists.

An issue was discovered in WSO2 Identity Server through 5.9.0 and WSO2 IS as Key Manager through 5.9.0. A potential Reflected Cros

An issue was discovered in WSO2 Identity Server through 5.9.0 and WSO2 IS as Key Manager through 5.9.0. A potential Reflected Cros

In WSO2 API Manager 3.0.0 and earlier, WSO2 API Microgateway 2.2.0, and WSO2 IS as Key Manager 5.9.0 and earlier, Management Conso

XXE during an EventPublisher update can occur in Management Console in WSO2 API Manager 3.0.0 and earlier, API Manager Analytics 2

An issue was discovered in WSO2 API Manager 2.1.0 and 2.6.0. Reflected XSS exists in the carbon part of the product.

Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities

Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs

Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures

Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1

About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service

threatengine.sh · Open-source threat intelligence platform · 100+ authoritative sources · Every fact traces to its origin