WSO2 Multiple Products Unrestrictive Upload of File Vulnerability

A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services in multiple WSO2 products

Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be…

An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account recovery-related SOAP admin service

Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products

XML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of Service

An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser

A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method for state-changing operations within admin services,…

Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution

Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks

An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services

An authenticated remote code execution (RCE) vulnerability exists in multiple WSO2 products due to improper input validation in the event processor admin service

An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs

Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification

A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encoding

Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions

A privilege escalation vulnerability exists in multiple WSO2 products due to a business logic flaw in SOAP admin services

Role Overwriting via Silent JIT Provisioning in Multiple WSO2 Products Enables Privilege Escalation

An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products

Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation

Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access

SSRF and Reflected XSS Vulnerabilities exist in multiple WSO2 products within the deprecated Try-It feature, which was accessible only to administrative users

Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products

An incorrect authorization vulnerability exists in multiple WSO2 products that allows unauthorized access to versioned files stored in the registry

An incorrect authorization vulnerability exists in multiple WSO2 products due to a flaw in the SOAP admin service, which allows user account creation regardless of the…

Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery