Search for packages
| purl | pkg:maven/org.apache.cxf/cxf-api@2.6.17 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2019-12406
|
Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. This … | There are no reported fixed by versions. |
|
CVE-2017-12624
|
Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications. It is possible to craft a … | There are no reported fixed by versions. |
|
CVE-2020-13954
|
Cross-site Scripting By default, Apache CXF creates a `/services` page containing a listing of the available endpoint names and addresses. … | There are no reported fixed by versions. |
|
CVE-2021-22696
|
Uncontrolled Resource Consumption CXF supports (via `JwtRequestCodeFilter`) passing OAuth 2 parameters via a JWT token as opposed to query parameters … | There are no reported fixed by versions. |
| Advisory | Summary | Aliases |
|---|---|---|
|
CVE-2014-0109
|
Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (memory consumption) via … | |
|
CVE-2012-5633
|
The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security … | |
|
CVE-2014-0110
|
Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (/tmp disk consumption) … |