Enterprise Integrator

enterprise_integrator

Vendor: Wso2 • 32 CVEs

CVEs (32)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2022-29464 1Wso2 8Api Manager Enterprise IntegratorIdentity Server+5 more Jun 17, 2026 Apr 18, 2022 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under t...Show more Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposition directory traversal sequence to reach a directory under the web root, such as a ../../../../repository/deployment/server/webapps directory. This affects WSO2 API Manager 2.2.0 up to 4.0.0, WSO2 Identity Server 5.2.0 up to 5.11.0, WSO2 Identity Server Analytics 5.4.0, 5.4.1, 5.5.0 and 5.6.0, WSO2 Identity Server as Key Manager 5.3.0 up to 5.11.0, WSO2 Enterprise Integrator 6.2.0 up to 6.6.0, WSO2 Open Banking AM 1.4.0 up to 2.0.0 and WSO2 Open Banking KM 1.4.0, up to 2.0.0.Show less
CVE-2020-17453 1Wso2 8Api Manager Api Manager AnalyticsApi Microgateway+5 more Jun 17, 2026 Apr 5, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter.
CVE-2020-25516 1Wso2 1Enterprise Integrator Jun 17, 2026 Oct 29, 2020 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 WSO2 Enterprise Integrator 6.6.0 or earlier contains a stored cross-site scripting (XSS) vulnerability in BPMN explorer tasks.
CVE-2020-24704 1Wso2 9Api Manager Api Manager AnalyticsApi Microgateway+6 more Jun 17, 2026 Aug 27, 2020 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager 2.2.0, API Manager Analytics 2.2.0, API Microgateway 2.2.0, Data Analytics Server 3.2.0, Enterprise Integra...Show more An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager 2.2.0, API Manager Analytics 2.2.0, API Microgateway 2.2.0, Data Analytics Server 3.2.0, Enterprise Integrator through 6.6.0, IS as Key Manager 5.5.0, Identity Server 5.5.0 and 5.8.0, Identity Server Analytics 5.5.0, and IoT Server 3.3.0 and 3.3.1.Show less
CVE-2020-24703 1Wso2 9Api Manager Api Manager AnalyticsApi Microgateway+6 more Jun 17, 2026 Aug 27, 2020 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-controlled server if the victim submits a crafted Try It request, aka Session Hijacking. This...Show more An issue was discovered in certain WSO2 products. A valid Carbon Management Console session cookie may be sent to an attacker-controlled server if the victim submits a crafted Try It request, aka Session Hijacking. This affects API Manager 2.2.0, API Manager Analytics 2.2.0, API Microgateway 2.2.0, Data Analytics Server 3.2.0, Enterprise Integrator through 6.6.0, IS as Key Manager 5.5.0, Identity Server 5.5.0 and 5.8.0, Identity Server Analytics 5.5.0, and IoT Server 3.3.0 and 3.3.1.Show less
CVE-2020-24591 1Wso2 5Api Manager Api Manager AnalyticsApi Microgateway+2 more Jun 17, 2026 Aug 21, 2020 N/A· v4 6.5 MEDIUM· v3 5.5 MEDIUM· v2 The Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates. This affects API Manager through 3.0.0, API Manager Analytics 2.2.0 and 2.5.0, API Microgateway 2.2.0, Enterprise Integrato...Show more The Management Console in certain WSO2 products allows XXE attacks during EventReceiver updates. This affects API Manager through 3.0.0, API Manager Analytics 2.2.0 and 2.5.0, API Microgateway 2.2.0, Enterprise Integrator 6.2.0 and 6.3.0, and Identity Server Analytics through 5.6.0.Show less
CVE-2020-12719 1Wso2 7Api Manager Api Manager AnalyticsApi Microgateway+4 more Jun 17, 2026 May 8, 2020 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 XXE during an EventPublisher update can occur in Management Console in WSO2 API Manager 3.0.0 and earlier, API Manager Analytics 2.5.0 and earlier, API Microgateway 2.2.0, Enterprise Integrator 6.4.0 and earlier, IS as K...Show more XXE during an EventPublisher update can occur in Management Console in WSO2 API Manager 3.0.0 and earlier, API Manager Analytics 2.5.0 and earlier, API Microgateway 2.2.0, Enterprise Integrator 6.4.0 and earlier, IS as Key Manager 5.9.0 and earlier, Identity Server 5.9.0 and earlier, and Identity Server Analytics 5.6.0 and earlier.Show less
CVE-2020-11885 1Wso2 1Enterprise Integrator Jun 17, 2026 Apr 17, 2020 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 WSO2 Enterprise Integrator through 6.6.0 has an XXE vulnerability where a user (with admin console access) can use the XML validator to make unintended network invocations such as SSRF via an uploaded file.
CVE-2019-20443 1Wso2 3Api Manager Enterprise IntegratorIdentity Server Jun 17, 2026 Jan 28, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. A potential stored Cross-Site Scripting (XSS) vulnerability in mediaType...Show more An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. A potential stored Cross-Site Scripting (XSS) vulnerability in mediaType has been identified in the registry UI.Show less
CVE-2019-20442 1Wso2 3Api Manager Enterprise IntegratorIdentity Server Jun 17, 2026 Jan 28, 2020 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. A potential stored Cross-Site Scripting (XSS) vulnerability in roleToAuth...Show more An issue was discovered in WSO2 API Manager 2.6.0, WSO2 Enterprise Integrator 6.5.0, WSO2 IS as Key Manager 5.7.0, and WSO2 Identity Server 5.8.0. A potential stored Cross-Site Scripting (XSS) vulnerability in roleToAuthorize has been identified in the registry UI.Show less
CVE-2019-19587 1Wso2 1Enterprise Integrator Jun 17, 2026 Dec 5, 2019 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 In WSO2 Enterprise Integrator 6.5.0, reflected XSS occurs when updating the message processor configuration from the source view in the Management Console.
CVE-2017-14651 1Wso2 17Api Manager App ManagerApplication Server+14 more May 13, 2026 Sep 21, 2017 N/A· v4 4.8 MEDIUM· v3 3.5 LOW· v2 WSO2 Data Analytics Server 3.1.0 has XSS in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter.

Previous 12