VulnerableCode Package Details - pkg:maven/org.apache.cxf/cxf-rt-transports-http@2.7.7

Search for packages

Advisory	Summary	Fixed in package version
CVE-2019-17573	By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage …	3.2.12 Vulnerable 3.2.13 Vulnerable 3.2.14 Vulnerable 3.3.5 Vulnerable 3.3.6 Vulnerable 3.3.7 Vulnerable
CVE-2014-0110	Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (/tmp disk consumption) …	2.6.16 Vulnerable 2.6.17 Vulnerable 2.7.11 Vulnerable 2.7.13 Vulnerable 2.7.16 Vulnerable 2.7.17 Vulnerable 2.7.18 Vulnerable 3.0.0 Vulnerable 3.0.2 Vulnerable 3.0.3 Vulnerable 3.0.4 Vulnerable 3.0.9 Vulnerable 3.1.1 Vulnerable 3.1.2 Vulnerable 3.1.4 Vulnerable 3.1.5 Vulnerable 3.1.6 Vulnerable 3.1.11 Vulnerable 3.2.12 Vulnerable 3.3.5 Vulnerable
CVE-2016-6812	Cross-site Scripting The HTTP transport module in Apache CXF uses `FormattedServiceListWriter` to provide an HTML page which lists the names …	3.0.12 Vulnerable 3.1.9 Vulnerable
CVE-2020-13954	Cross-site Scripting By default, Apache CXF creates a `/services` page containing a listing of the available endpoint names and addresses. …	3.3.8 Vulnerable 3.4.1 Vulnerable
CVE-2021-22696	Uncontrolled Resource Consumption CXF supports (via `JwtRequestCodeFilter`) passing OAuth 2 parameters via a JWT token as opposed to query parameters …	3.3.10 Not vulnerable 3.4.3 Not vulnerable
GHSA-jc7r-v6fg-2gpf Aliases: CVE-2018-8039	Apache CXF TLS hostname verification does not work correctly with com.sun.net.ssl.* It is possible to configure Apache CXF to use …	3.1.16 Vulnerable 3.1.16 Vulnerable

Advisory

Summary

Fixed in package version

CVE-2019-17573

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage …

3.2.12
Vulnerable

3.2.13
Vulnerable

3.2.14
Vulnerable

3.3.5
Vulnerable

3.3.6
Vulnerable

3.3.7
Vulnerable

CVE-2014-0110

Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (/tmp disk consumption) …

2.6.16
Vulnerable

2.6.17
Vulnerable

2.7.11
Vulnerable

2.7.13
Vulnerable

2.7.16
Vulnerable

2.7.17
Vulnerable

2.7.18
Vulnerable

3.0.0
Vulnerable

3.0.2
Vulnerable

3.0.3
Vulnerable

3.0.4
Vulnerable

3.0.9
Vulnerable

3.1.1
Vulnerable

3.1.2
Vulnerable

3.1.4
Vulnerable

3.1.5
Vulnerable

3.1.6
Vulnerable

3.1.11
Vulnerable

3.2.12
Vulnerable

3.3.5
Vulnerable

CVE-2016-6812

Cross-site Scripting The HTTP transport module in Apache CXF uses `FormattedServiceListWriter` to provide an HTML page which lists the names …

3.0.12
Vulnerable

3.1.9
Vulnerable

CVE-2020-13954

Cross-site Scripting By default, Apache CXF creates a `/services` page containing a listing of the available endpoint names and addresses. …

3.3.8
Vulnerable

3.4.1
Vulnerable

CVE-2021-22696

Uncontrolled Resource Consumption CXF supports (via `JwtRequestCodeFilter`) passing OAuth 2 parameters via a JWT token as opposed to query parameters …

3.3.10
Not vulnerable

3.4.3
Not vulnerable

GHSA-jc7r-v6fg-2gpf
Aliases:
CVE-2018-8039

Apache CXF TLS hostname verification does not work correctly with com.sun.net.ssl.* It is possible to configure Apache CXF to use …

3.1.16
Vulnerable

Next non-vulnerable version	3.3.10
Latest non-vulnerable version	4.0.5
Risk score	3.6