Search for packages
| purl | pkg:maven/org.apache.cxf/cxf-rt-frontend-jaxrs@2.6.6 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-gtfj-ry3n-aaae
Aliases: CVE-2020-13954 GHSA-64x2-gq24-75pv |
Cross-site scripting in Apache CXF |
Affected by 1 other vulnerability. Affected by 1 other vulnerability. |
|
VCID-su1r-fv61-aaap
Aliases: CVE-2013-2160 GHSA-254q-rp36-v2m8 |
Denial of Service Attacks on Apache CXF The streaming XML parser in this package remote attackers to cause a denial of service (CPU and memory consumption) via crafted XML with a large number of elements, attributes, nested constructs, and possibly other vectors. |
Affected by 3 other vulnerabilities. Affected by 3 other vulnerabilities. |
|
VCID-vq6d-cmr8-aaah
Aliases: CVE-2014-3584 GHSA-gw5j-77f9-v2g2 |
Denial of Service (DoS) via invalid JAX-RS SAML tokens The `SamlHeaderInHandler` in this package allows remote attackers to cause a denial of service (infinite loop) via a crafted SAML token in the authorization header of a request to a JAX-RS service. |
Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 3 other vulnerabilities. |
|
VCID-zggp-qr1y-aaaf
Aliases: CVE-2021-22696 GHSA-7q4h-pj78-j7vg |
Authorization service vulnerable to DDos attacks in Apache CFX |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-m6hu-ghyn-aaan | UsernameTokenPolicyValidator and UsernameTokenInterceptor allow empty passwords to authenticate When the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element. |
CVE-2013-0239
GHSA-p5c5-6564-vvr8 |