← Back

Wso2

wso2

139 CVEs • 35 products

Products (35)

Click to collapse
Toggle
Api Manager
api_manager
95 CVEs
Identity Server
identity_server
83 CVEs
Identity Server As Key Manager
identity_server_as_key_manager
52 CVEs
Enterprise Integrator
enterprise_integrator
33 CVEs
Open Banking Iam
open_banking_iam
33 CVEs
Api Control Plane
api_control_plane
31 CVEs
Traffic Manager
traffic_manager
27 CVEs
Open Banking Am
open_banking_am
26 CVEs
Universal Gateway
universal_gateway
26 CVEs
Api Manager Analytics
api_manager_analytics
11 CVEs
Api Microgateway
api_microgateway
11 CVEs
Identity Server Analytics
identity_server_analytics
11 CVEs
Open Banking Km
open_banking_km
9 CVEs
Data Analytics Server
data_analytics_server
7 CVEs
Iot Server
iot_server
7 CVEs
Micro Integrator
micro_integrator
5 CVEs
Dashboard Server
dashboard_server
4 CVEs
Carbon
carbon
3 CVEs
Application Server
application_server
2 CVEs
Business Process Server
business_process_server
2 CVEs
Business Rules Server
business_rules_server
2 CVEs
Complex Event Processor
complex_event_processor
2 CVEs
Data Services Server
data_services_server
2 CVEs
Enterprise Mobility Manager
enterprise_mobility_manager
2 CVEs
Machine Learner
machine_learner
2 CVEs
Message Broker
message_broker
2 CVEs
Carbon Registry
carbon-registry
2 CVEs
Enterprise Service Bus
enterprise_service_bus
2 CVEs
Enablement Server For Java
enablement_server_for_java
1 CVE
App Manager
app_manager
1 CVE
Governance Registry
governance_registry
1 CVE
Storage Server
storage_server
1 CVE
Transport Http
transport-http
1 CVE
Carbon Identity Application Authentication Endpoint
carbon_identity_application_authentication_endpoint
1 CVE
Carbon Identity Application Authentication Framework
carbon_identity_application_authentication_framework
1 CVE

CVEs (139)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2019-18882
1Wso2
1Identity Server
Jun 17, 2026
Nov 12, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
WSO2 IS as Key Manager 5.7.0 allows stored XSS in download-userinfo.jag because Content-Type is mishandled.
CVE-2019-18881
1Wso2
1Identity Server
Jun 17, 2026
Nov 12, 2019
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
WSO2 IS as Key Manager 5.7.0 allows unauthenticated reflected XSS in the dashboard user profile.
CVE-2019-15108
1Wso2
1Api Manager
Jun 17, 2026
Aug 16, 2019
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
An issue was discovered in WSO2 API Manager 2.6.0 before WSO2-CARBON-PATCH-4.4.0-4457. There is XSS via a crafted filename to the file-upload feature of the event simulator component.
CVE-2019-6513
1Wso2
1Api Manager
Jun 17, 2026
May 21, 2019
N/A· v4
5.4 MEDIUM· v3
5.5 MEDIUM· v2
An issue was discovered in WSO2 API Manager 2.6.0. It is possible for a logged-in user to upload, as API documentation, any type of file by changing the extension to an allowed one.
CVE-2019-6516
1Wso2
1Dashboard Server
Jun 17, 2026
May 14, 2019
N/A· v4
5.8 MEDIUM· v3
5.0 MEDIUM· v2
An issue was discovered in WSO2 Dashboard Server 2.0.0. It is possible to force the application to perform requests to the internal workstation (port-scanning) and to perform requests to adjacent workstations (network-sc...Show more
An issue was discovered in WSO2 Dashboard Server 2.0.0. It is possible to force the application to perform requests to the internal workstation (port-scanning) and to perform requests to adjacent workstations (network-scanning), aka SSRF.Show less
CVE-2019-6515
1Wso2
1Api Manager
Jun 17, 2026
May 14, 2019
N/A· v4
5.3 MEDIUM· v3
5.0 MEDIUM· v2
An issue was discovered in WSO2 API Manager 2.6.0. Uploaded documents for API documentation are available to an unauthenticated user.
CVE-2019-6514
1Wso2
1Dashboard Server
Jun 17, 2026
May 14, 2019
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
An issue was discovered in WSO2 Dashboard Server 2.0.0. It is possible to inject a JavaScript payload that will be stored in the database and then displayed and executed on the same page, aka XSS.
CVE-2019-6512
1Wso2
1Api Manager
Jun 17, 2026
May 14, 2019
N/A· v4
4.1 MEDIUM· v3
4.0 MEDIUM· v2
An issue was discovered in WSO2 API Manager 2.6.0. It is possible to force the application to perform requests to the internal workstation (SSRF port-scanning), other adjacent workstations (SSRF network scanning), or to...Show more
An issue was discovered in WSO2 API Manager 2.6.0. It is possible to force the application to perform requests to the internal workstation (SSRF port-scanning), other adjacent workstations (SSRF network scanning), or to enumerate files because of the existence of the file:// wrapper.Show less
CVE-2018-20737
1Wso2
3Api Manager
Identity ServerIdentity Server As Key Manager
Nov 21, 2024
Mar 21, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
An issue was discovered in WSO2 API Manager 2.1.0 and 2.6.0. Reflected XSS exists in the carbon part of the product.
CVE-2018-20736
1Wso2
1Api Manager
Nov 21, 2024
Mar 21, 2019
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
An issue was discovered in WSO2 API Manager 2.1.0 and 2.6.0. A DOM-based XSS exists in the store part of the product.
CVE-2018-8716
1Wso2
1Identity Server
Jun 17, 2026
Apr 25, 2018
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
WSO2 Identity Server before 5.5.0 has XSS via the dashboard, allowing attacks by low-privileged attackers.
CVE-2017-14995
1Wso2
8Application Server
Business Process ServerBusiness Rules Server+5 more
May 13, 2026
Oct 4, 2017
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The Management Console in WSO2 Application Server 5.3.0, WSO2 Business Process Server 3.6.0, WSO2 Business Rules Server 2.2.0, WSO2 Complex Event Processor 4.2.0, WSO2 Dashboard Server 2.0.0, WSO2 Data Analytics Server 3...Show more
The Management Console in WSO2 Application Server 5.3.0, WSO2 Business Process Server 3.6.0, WSO2 Business Rules Server 2.2.0, WSO2 Complex Event Processor 4.2.0, WSO2 Dashboard Server 2.0.0, WSO2 Data Analytics Server 3.1.0, WSO2 Data Services Server 3.5.1, and WSO2 Machine Learner 1.2.0 is affected by stored XSS.Show less
CVE-2017-14651
1Wso2
17Api Manager
App ManagerApplication Server+14 more
May 13, 2026
Sep 21, 2017
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
WSO2 Data Analytics Server 3.1.0 has XSS in carbon/resources/add_collection_ajaxprocessor.jsp via the collectionName or parentPath parameter.
CVE-2016-4327
1Wso2
1Enablement Server For Java
May 13, 2026
Feb 17, 2017
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Cross-site scripting (XSS) vulnerability in WSO2 SOA Enablement Server for Java/6.6 build SSJ-6.6-20090827-1616 and earlier allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
CVE-2016-4316
1Wso2
1Carbon
May 13, 2026
Feb 17, 2017
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Multiple cross-site scripting (XSS) vulnerabilities in WSO2 Carbon 4.4.5 allow remote attackers to inject arbitrary web script or HTML via the (1) setName parameter to identity-mgt/challenges-mgt.jsp; the (2) webappType...Show more
Multiple cross-site scripting (XSS) vulnerabilities in WSO2 Carbon 4.4.5 allow remote attackers to inject arbitrary web script or HTML via the (1) setName parameter to identity-mgt/challenges-mgt.jsp; the (2) webappType or (3) httpPort parameter to webapp-list/webapp_info.jsp; the (4) dsName or (5) description parameter to ndatasource/newdatasource.jsp; the (6) phase parameter to viewflows/handlers.jsp; or the (7) url parameter to ndatasource/validateconnection-ajaxprocessor.jsp.Show less
CVE-2016-4315
1Wso2
1Carbon
May 13, 2026
Feb 17, 2017
N/A· v4
5.7 MEDIUM· v3
3.5 LOW· v2
Cross-site request forgery (CSRF) vulnerability in WSO2 Carbon 4.4.5 allows remote attackers to hijack the authentication of privileged users for requests that shutdown a server via a shutdown action to server-admin/prox...Show more
Cross-site request forgery (CSRF) vulnerability in WSO2 Carbon 4.4.5 allows remote attackers to hijack the authentication of privileged users for requests that shutdown a server via a shutdown action to server-admin/proxy_ajaxprocessor.jsp.Show less
CVE-2016-4314
1Wso2
1Carbon
May 13, 2026
Feb 17, 2017
N/A· v4
4.9 MEDIUM· v3
4.0 MEDIUM· v2
Directory traversal vulnerability in the LogViewer Admin Service in WSO2 Carbon 4.4.5 allows remote authenticated administrators to read arbitrary files via a .. (dot dot) in the logFile parameter to downloadgz-ajaxproce...Show more
Directory traversal vulnerability in the LogViewer Admin Service in WSO2 Carbon 4.4.5 allows remote authenticated administrators to read arbitrary files via a .. (dot dot) in the logFile parameter to downloadgz-ajaxprocessor.jsp.Show less
CVE-2016-4312
1Wso2
1Identity Server
May 13, 2026
Feb 17, 2017
N/A· v4
7.5 HIGH· v3
6.0 MEDIUM· v2
XML external entity (XXE) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 before WSO2-CARBON-PATCH-4.4.0-0231 allows remote authenticated users with access to XACML features to read arbitrary files,...Show more
XML external entity (XXE) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 before WSO2-CARBON-PATCH-4.4.0-0231 allows remote authenticated users with access to XACML features to read arbitrary files, cause a denial of service, conduct server-side request forgery (SSRF) attacks, or have unspecified other impact via a crafted XACML request to entitlement/eval-policy-submit.jsp. NOTE: this issue can be combined with CVE-2016-4311 to exploit the vulnerability without credentials.Show less
CVE-2016-4311
1Wso2
1Identity Server
May 13, 2026
Feb 17, 2017
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
Cross-site request forgery (CSRF) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 allows remote attackers to hijack the authentication of privileged users for requests that process XACML requests vi...Show more
Cross-site request forgery (CSRF) vulnerability in the XACML flow feature in WSO2 Identity Server 5.1.0 allows remote attackers to hijack the authentication of privileged users for requests that process XACML requests via an entitlement/eval-policy-submit.jsp request.Show less