Search for packages
| purl | pkg:maven/org.apache.cxf/cxf@2.5.7 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-64x2-gq24-75pv
Aliases: CVE-2020-13954 |
Cross-site scripting in Apache CXF By default, Apache CXF creates a /services page containing a listing of the available endpoint … |
Vulnerable |
|
GHSA-7q4h-pj78-j7vg
Aliases: CVE-2021-22696 |
Authorization service vulnerable to DDos attacks in Apache CFX CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT … |
Vulnerable |
|
GHSA-xf9f-32gh-h2w4
Aliases: CVE-2012-5633 |
Improper Authentication in Apache CXF The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when … |
Vulnerable |
|
GHSA-g23v-p5jq-jvh4
Aliases: CVE-2021-30468 |
Infinite loop in Apache CFX A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON … |
Vulnerable |
|
GHSA-cw6w-q88j-6mqf
Aliases: CVE-2019-12419 |
Potential session hijack in Apache CXF Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required … |
Vulnerable |
|
GHSA-58p8-9g59-q2hr
Aliases: CVE-2019-12406 |
Potential DOS attack due to unrestricted attachment count in messages Apache CXF before 3.3.4 and 3.2.11 does not restrict the … |
Vulnerable |
|
GHSA-f93p-f762-vr53
Aliases: CVE-2019-17573 |
Reflected Cross-Site Scripting in Apache CXF By default, Apache CXF creates a /services page containing a listing of the available … |
Vulnerable |
|
GHSA-42f2-f9vc-6365
Aliases: CVE-2019-12423 |
Private key leak in Apache CXF Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client … |
Vulnerable |
|
CVE-2020-1954
Aliases: GHSA-ffm7-7r8g-77xm |
Exposure of Sensitive Information to an Unauthorized Actor in Apache CXF Apache CXF has the ability to integrate with JMX … |
Vulnerable |
|
CVE-2022-46364
|
Server-Side Request Forgery (SSRF) A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of … |
Not vulnerable Not vulnerable |
|
CVE-2022-46363
|
Improper Input Validation A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote … |
Not vulnerable Not vulnerable |
|
CVE-2018-8039
|
Improper Handling of Exceptional Conditions It is possible to configure Apache CXF to use the `com.sun.net.ssl` implementation via `System.setProperty`. When … |
Vulnerable Vulnerable Vulnerable Vulnerable |