Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.apache.cxf/cxf-rt-ws-security@2.5.5
purl pkg:maven/org.apache.cxf/cxf-rt-ws-security@2.5.5
Next non-vulnerable version 2.6.12
Latest non-vulnerable version 3.3.5
Risk score
Vulnerabilities affecting this package (3)
Advisory Summary Fixed in package version
GHSA-38x2-fp9m-87mx
Aliases:
CVE-2014-0034
Improper Input Validation in Apache CXF The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not …
2.6.12
Not vulnerable
CVE-2013-0239

UsernameTokenPolicyValidator and UsernameTokenInterceptor allow empty passwords to authenticate When the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass …
2.5.9
Vulnerable
2.6.6
Vulnerable
2.7.3
Vulnerable
CVE-2012-5633

Bypass of security constraints on WS endpoints when using WSS4JInInterceptor The `URIMappingInterceptor` in this package bypasses `WS-Security` processing, which allows …
2.6.5
Vulnerable
2.5.8
Vulnerable
2.7.2
Vulnerable
2.6.5
Vulnerable
2.5.8
Vulnerable
2.7.2
Vulnerable
This package is not known to fix any advisories.