Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.apache.cxf/cxf-rt-ws-security@2.6.5
purl pkg:maven/org.apache.cxf/cxf-rt-ws-security@2.6.5
Next non-vulnerable version 2.6.12
Latest non-vulnerable version 3.3.5
Risk score
Vulnerabilities affecting this package (2)
Advisory Summary Fixed in package version
GHSA-38x2-fp9m-87mx
Aliases:
CVE-2014-0034
Improper Input Validation in Apache CXF The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not …
2.6.12
Not vulnerable
CVE-2013-0239

UsernameTokenPolicyValidator and UsernameTokenInterceptor allow empty passwords to authenticate When the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass …
2.5.9
Vulnerable
2.6.6
Vulnerable
2.7.3
Vulnerable
Vulnerabilities fixed by this package (1)

Advisory Summary Aliases
CVE-2012-5633
Bypass of security constraints on WS endpoints when using WSS4JInInterceptor The `URIMappingInterceptor` in this package bypasses `WS-Security` processing, which allows …