← Back

Wso2

wso2

123 CVEs • 35 products

Products (35)

Click to collapse
Toggle
Api Manager
api_manager
83 CVEs
Identity Server
identity_server
70 CVEs
Identity Server As Key Manager
identity_server_as_key_manager
44 CVEs
Enterprise Integrator
enterprise_integrator
32 CVEs
Open Banking Iam
open_banking_iam
25 CVEs
Api Control Plane
api_control_plane
20 CVEs
Open Banking Am
open_banking_am
19 CVEs
Traffic Manager
traffic_manager
18 CVEs
Universal Gateway
universal_gateway
17 CVEs
Api Manager Analytics
api_manager_analytics
11 CVEs
Api Microgateway
api_microgateway
11 CVEs
Identity Server Analytics
identity_server_analytics
11 CVEs
Open Banking Km
open_banking_km
8 CVEs
Data Analytics Server
data_analytics_server
7 CVEs
Iot Server
iot_server
7 CVEs
Micro Integrator
micro_integrator
5 CVEs
Dashboard Server
dashboard_server
4 CVEs
Carbon
carbon
3 CVEs
Application Server
application_server
2 CVEs
Business Process Server
business_process_server
2 CVEs
Business Rules Server
business_rules_server
2 CVEs
Complex Event Processor
complex_event_processor
2 CVEs
Data Services Server
data_services_server
2 CVEs
Enterprise Mobility Manager
enterprise_mobility_manager
2 CVEs
Machine Learner
machine_learner
2 CVEs
Message Broker
message_broker
2 CVEs
Carbon Registry
carbon-registry
2 CVEs
Enterprise Service Bus
enterprise_service_bus
2 CVEs
Enablement Server For Java
enablement_server_for_java
1 CVE
App Manager
app_manager
1 CVE
Governance Registry
governance_registry
1 CVE
Storage Server
storage_server
1 CVE
Transport Http
transport-http
1 CVE
Carbon Identity Application Authentication Endpoint
carbon_identity_application_authentication_endpoint
1 CVE
Carbon Identity Application Authentication Framework
carbon_identity_application_authentication_framework
1 CVE

CVEs (123)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2016-4314
1Wso2
1Carbon
May 13, 2026
Feb 17, 2017
N/A· v4
4.9 MEDIUM· v3
4.0 MEDIUM· v2
Directory traversal vulnerability in the LogViewer Admin Service in WSO2 Carbon 4.4.5 allows remote authenticated administrators to read arbitrary files via a .. (dot dot) in the logFile parameter to downloadgz-ajaxproce...Show more
Directory traversal vulnerability in the LogViewer Admin Service in WSO2 Carbon 4.4.5 allows remote authenticated administrators to read arbitrary files via a .. (dot dot) in the logFile parameter to downloadgz-ajaxprocessor.jsp.Show less
CVE-2016-4312
1Wso2
1Identity Server
May 13, 2026
Feb 17, 2017
N/A· v4
7.5 HIGH· v3
6.0 MEDIUM· v2
XML external entity (XXE) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 before WSO2-CARBON-PATCH-4.4.0-0231 allows remote authenticated users with access to XACML features to read arbitrary files,...Show more
XML external entity (XXE) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 before WSO2-CARBON-PATCH-4.4.0-0231 allows remote authenticated users with access to XACML features to read arbitrary files, cause a denial of service, conduct server-side request forgery (SSRF) attacks, or have unspecified other impact via a crafted XACML request to entitlement/eval-policy-submit.jsp. NOTE: this issue can be combined with CVE-2016-4311 to exploit the vulnerability without credentials.Show less
CVE-2016-4311
1Wso2
1Identity Server
May 13, 2026
Feb 17, 2017
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
Cross-site request forgery (CSRF) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 allows remote attackers to hijack the authentication of privileged users for requests that process XACML requests vi...Show more
Cross-site request forgery (CSRF) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 allows remote attackers to hijack the authentication of privileged users for requests that process XACML requests via an entitlement/eval-policy-submit.jsp request.Show less