Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.apache.cxf/cxf-rt-ws-security@2.4.10
purl pkg:maven/org.apache.cxf/cxf-rt-ws-security@2.4.10
Next non-vulnerable version 2.6.12
Latest non-vulnerable version 3.3.5
Risk score
Vulnerabilities affecting this package (2)
Advisory Summary Fixed in package version
GHSA-38x2-fp9m-87mx
Aliases:
CVE-2014-0034
Improper Input Validation in Apache CXF The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not …
2.6.12
Not vulnerable
CVE-2013-0239

UsernameTokenPolicyValidator and UsernameTokenInterceptor allow empty passwords to authenticate When the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass …
2.5.9
Vulnerable
2.6.6
Vulnerable
2.7.3
Vulnerable
This package is not known to fix any advisories.