RSS   Vulnerabilities for 'Carbon'   RSS



Multiple cross-site scripting (XSS) vulnerabilities in WSO2 Carbon 4.4.5 allow remote attackers to inject arbitrary web script or HTML via the (1) setName parameter to identity-mgt/challenges-mgt.jsp; the (2) webappType or (3) httpPort parameter to webapp-list/webapp_info.jsp; the (4) dsName or (5) description parameter to ndatasource/newdatasource.jsp; the (6) phase parameter to viewflows/handlers.jsp; or the (7) url parameter to ndatasource/validateconnection-ajaxprocessor.jsp.



Cross-site request forgery (CSRF) vulnerability in WSO2 Carbon 4.4.5 allows remote attackers to hijack the authentication of privileged users for requests that shutdown a server via a shutdown action to server-admin/proxy_ajaxprocessor.jsp.



Directory traversal vulnerability in the LogViewer Admin Service in WSO2 Carbon 4.4.5 allows remote authenticated administrators to read arbitrary files via a .. (dot dot) in the logFile parameter to downloadgz-ajaxprocessor.jsp.


 >>> Vendor: WSO2 25 Products
Enablement server for java
Identity server
Storage server
Data analytics server
Iot server
Enterprise integrator
Business rules server
Api manager
Business process server
Dashboard server
Message broker
Enterprise mobility manager
Application server
Data services server
Complex event processor
Governance registry
App manager
Machine learner
Identity server as key manager
Api manager analytics
Api microgateway
Identity server analytics
Api microgatewa
Micro integrator

Copyright 2021,


Back to Top