Search for packages
| purl | pkg:maven/org.apache.cxf/cxf-rt-ws-security@2.5.2 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-7uaz-br64-aaar
Aliases: CVE-2014-0034 GHSA-38x2-fp9m-87mx |
CVE-2014-0034 Apache CXF: The SecurityTokenService accepts certain invalid SAML Tokens as valid |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-bd4x-va5p-aaar
Aliases: CVE-2012-5633 GHSA-xf9f-32gh-h2w4 |
Bypass of security constraints on WS endpoints when using WSS4JInInterceptor The `URIMappingInterceptor` in this package bypasses `WS-Security` processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request. |
Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-m6hu-ghyn-aaan
Aliases: CVE-2013-0239 GHSA-p5c5-6564-vvr8 |
UsernameTokenPolicyValidator and UsernameTokenInterceptor allow empty passwords to authenticate When the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element. |
Affected by 1 other vulnerability. Affected by 1 other vulnerability. Affected by 1 other vulnerability. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||