Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.6A reflected cross-site scripting (XSS) vulnerability exists in the sub-organization login flow of WSO2 Identity Server 7.0.0 due to improper input validation.Check this weekEPSS 22.00%May 22, 2025
- Critical9.8An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account recovery-related SOAP admin service.Check this weekEPSS 72.00%May 22, 2025
- Critical9.8In Jenkins WSO2 Oauth Plugin 1.0 and earlier, authentication claims are accepted without validation by the "WSO2 Oauth" security realm, allowing unauthenticated attackers to log inCheck if you run itEPSS 0.65%May 14, 2025
- Critical9.1Due to the improper configuration of XML parser, user-supplied XML is parsed without applying sufficient restrictions, enabling XML External Entity (XXE) resolution in multiple WSOCheck if you run itEPSS 1.29%May 5, 2025
- UnknownWSO2 User Registration Arbitrary Account CreationPatch nowKEVEPSS 0.66%Feb 2, 2025
- UnknownWSO2 api_manager Improper Restriction of XML External Entity ReferencePatch nowKEVEPSS 26.28%Jan 22, 2024
- UnknownWSO2 api_manager Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Patch nowKEVEPSS 26.22%Nov 13, 2023
- Critical9.8WSO2 Multiple Products Unrestrictive Upload of File VulnerabilityPatch nowKEVEPSS 100.00%Apr 18, 2022
33 records · page 2 of 2
PreviousNext