Product:

Identity_server_as_key_manager

(Wso2)
Repositories

Unknown:

This might be proprietary software.
#Vulnerabilities 19
Date Id Summary Products Score Patch Annotated
2020-08-27 CVE-2020-24706 An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager through 3.1.0, API Manager Analytics 2.5.0, IS as Key Manager through 5.10.0, Identity Server through 5.10.0, Identity Server Analytics through 5.6.0, and IoT Server 3.1.0. Api_manager, Api_manager_analytics, Identity_server, Identity_server_analytics, Identity_server_as_key_manager, Iot_server 6.1
2021-04-05 CVE-2020-17453 WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter. Api_manager, Api_manager_analytics, Api_microgateway, Enterprise_integrator, Identity_server, Identity_server_analytics, Identity_server_as_key_manager, Micro_integrator 6.1
2021-12-07 CVE-2021-36760 In accountrecoveryendpoint/recoverpassword.do in WSO2 Identity Server 5.7.0, it is possible to perform a DOM-Based XSS attack affecting the callback parameter modifying the URL that precedes the callback parameter. Once the username or password reset procedure is completed, the JavaScript code will be executed. (recoverpassword.do also has an open redirect issue for a similar reason.) Api_manager, Identity_server, Identity_server_as_key_manager, Iot_server 6.1
2022-04-21 CVE-2022-29548 A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; API Manager Analytics 2.2.0, 2.5.0, and 2.6.0; API Microgateway 2.2.0; Data Analytics Server 3.2.0; Enterprise Integrator 6.2.0, 6.3.0, 6.4.0, 6.5.0, and 6.6.0; IS as Key Manager 5.5.0, 5.6.0, 5.7.0, 5.9.0, and 5.10.0; Identity Server 5.5.0, 5.6.0, 5.7.0, 5.9.0, 5.10.0, and 5.11.0; Identity Server Analytics 5.5.0 and 5.6.0; and WSO2... Api_manager, Api_manager_analytics, Api_microgateway, Data_analytics_server, Enterprise_integrator, Identity_server, Identity_server_analytics, Identity_server_as_key_manager, Micro_integrator 6.1
2022-05-11 CVE-2021-42646 XML External Entity (XXE) vulnerability in the file based service provider creation feature of the Management Console in WSO2 API Manager 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; and WSO2 IS as Key Manager 5.7.0, 5.9.0, and 5.10.0; and WSO2 Identity Server 5.7.0, 5.8.0, 5.9.0, 5.10.0, and 5.11.0. Allows attackers to gain read access to sensitive information or cause a denial of service via crafted GET requests. Api_manager, Identity_server, Identity_server_as_key_manager 9.1
2023-12-15 CVE-2023-6836 Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely used feature of XML parsers to access sensitive information. Api_manager, Api_manager_analytics, Api_microgateway, Enterprise_integrator, Identity_server, Identity_server_as_key_manager, Micro_integrator 7.5
2023-12-15 CVE-2023-6838 Reflected XSS vulnerability can be exploited by tampering a request parameter in Authentication Endpoint. This can be performed in both authenticated and unauthenticated requests. Api_manager, Identity_server, Identity_server_as_key_manager 6.1
2023-12-18 CVE-2023-6911 Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting (XSS) attack can be carried out by an attacker injecting a malicious payload into the Registry feature of the Management Console. Api_manager, Api_manager_analytics, Api_microgateway, Data_analytics_server, Enterprise_integrator, Identity_server, Identity_server_analytics, Identity_server_as_key_manager, Message_broker 4.8
2019-03-21 CVE-2018-20737 An issue was discovered in WSO2 API Manager 2.1.0 and 2.6.0. Reflected XSS exists in the carbon part of the product. Api_manager, Identity_server, Identity_server_as_key_manager 5.4