Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover

Privilege Escalation via System REST APIs in Multiple WSO2 Products Permits Admin Account Takeover

A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services in multiple WSO2 products

Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be…

Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products

An XML External Entity (XXE) vulnerability exists in multiple WSO2 products due to improper configuration of the XML parser

Improper Access Control via Gateway API in Multiple WSO2 Products Allows Unauthorized Operations

A Cross-Site Request Forgery (CSRF) vulnerability exists in multiple WSO2 products due to the use of the HTTP GET method for state-changing operations within admin services,…

Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service Disruption

Arbitrary Code Execution via Administrative Operations in Multiple WSO2 Products Allows Remote Code Execution

Account Lockout Failure via Secondary User Store Inaccessibility in Multiple WSO2 Products Allows Brute Force Attacks

HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation

Authenticated arbitrary file upload via a System REST API requiring administrator permission.

An arbitrary code execution vulnerability exists in multiple WSO2 products due to insufficient restrictions in the GraalJS and NashornJS Script Mediator engines

An arbitrary file upload vulnerability exists in multiple WSO2 products due to insufficient validation of uploaded content and destination in SOAP admin services

An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper input validation in the CarbonAppUploader admin service endpoint

An authenticated remote code execution (RCE) vulnerability exists in multiple WSO2 products due to improper input validation in the event processor admin service

An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs

Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification

A reflected cross-site scripting (XSS) vulnerability exists in the management console of multiple WSO2 products due to improper output encoding

Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure

Cross-Site Request Forgery via Ajax Processor Endpoints in Multiple WSO2 Products Enables Unauthorized Actions

An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products

Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access

SSRF and Reflected XSS Vulnerabilities exist in multiple WSO2 products within the deprecated Try-It feature, which was accessible only to administrative users

An authenticated stored cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to improper validation of user-supplied input during API document upload in…

Sensitive Information Disclosure via Event Publisher Logging in Multiple WSO2 Products