Search for packages
| purl | pkg:maven/org.apache.cxf/cxf-bundle@2.7.13 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2019-17573
|
By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage … | There are no reported fixed by versions. |
|
CVE-2019-12406
|
Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. This … | There are no reported fixed by versions. |
|
CVE-2017-12624
|
Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications. It is possible to craft a … | There are no reported fixed by versions. |
|
CVE-2020-1954
|
Apache CXF has the ability to integrate with JMX by registering an InstrumentationManager extension with the CXF bus. If the … | There are no reported fixed by versions. |
| Advisory | Summary | Aliases |
|---|---|---|
|
CVE-2014-0109
|
Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (memory consumption) via … | |
|
CVE-2013-0239
|
Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote … | |
|
CVE-2012-5633
|
The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security … | |
|
CVE-2014-0110
|
Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (/tmp disk consumption) … | |
|
CVE-2014-3584
|
The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before 3.0.1 allows remote attackers to cause a … |