Wso2 Open Banking Am

Vulnerabilities related to Wso2 Open Banking Am 15

• Medium 4.8 When utilizing JWT Bearer or SAML2 Bearer grant types, the system fails to validate the status of... CVE-2025-1397 Nov 3, 15:07
• Medium 4.9 The refresh token grant type in WSO2 products fails to re-validate account status before issuing... CVE-2024-9517 Nov 2, 20:30
• Medium 5.4 The affected components accept user-supplied input for constructing redirection URLs without... CVE-2024-2372 Nov 2, 20:00
• Medium 4.4 When an Event Publisher output adapter is configured with properties that are irrelevant to its... CVE-2026-18800 Nov 2, 18:59
• Critical 9.4 WSO2 API Managerに脆弱性2件、修正版が公開 WSO2 API ManagerのSystem REST APIsに、権限の低いユーザーが管理操作を実行できる脆弱性など2件が公表されました。該当版を洗い出して修正版へ更新し、Identity Serverを連携させている環境ではコネクタの版も確認してください。 CVE-2025-11969 Nov 2, 14:53
• Low 3.1 When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does... When the allowed_scopes configuration is enabled, the OAuth2 token introspection mechanism does... CVE-2026-3583 Oct 29, 04:21
• High 8.3 WSO2製品に認証不要でサーバーの代わりに内部リソースへ接続される脆弱性 WSO2のAPI Manager、Identity Serverなど複数の製品に、サーバーに任意のネットワーク先へリクエストを送らせる脆弱性(CVE-2025-14260)が見つかりました。認証なしで攻撃されるおそれがあり、CVSSは8.3です。修正版が公開されているため、利用中の製品と版を確認し、修正版へ更新してください。 CVE-2025-14260 Oct 29, 04:21
• Medium 5.8 When a WSO2 product is configured to use an external user store, the system fails to adequately... CVE-2024-7478 Oct 21, 23:17
• Medium 4.0 The product failed to enforce validation constraints on user-supplied input in URL parameters,... CVE-2024-6423 Oct 21, 23:17
• Medium 6.1 The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for... CVE-2024-5139 Oct 21, 23:17
• Medium 4.8 The RemoteUserStoreManagerService does not sufficiently validate password change attempts when... CVE-2024-2323 Oct 20, 17:16
• Medium 6.5 Tokens associated with user sessions are not revoked when the corresponding user session is... Vulnerability reported (CVE-2025-13173). Risk of unauthorized operations or information disclosure. CVE-2025-13173 Oct 20, 02:16
• Low 2.7 The software accepts user-supplied data without sufficient validation, allowing for the injection... Code injection reported (CVE-2024-4412). Risk of unauthorized operations or information disclosure. CVE-2024-4412 Oct 20, 02:16
• Critical 9.1 OS Command Injection in Management Console CVE-2024-4457 Oct 19, 03:32
• Medium 5.4 Vulnerability in Wso2 Api Control Plane CVE-2026-0637 Aug 6, 17:16