Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.cxf:apache-cxf

7 known vulnerabilities, with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
7
Registry
Maven Central

Advisories 7

  • Apache CXF Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter

    Affected: from 3.4.0, fixed in 3.4.4; fixed in 3.3.11.

  • OAuth 2 authorization service vulnerable to DDos attacks

    Affected: from 3.4.0, fixed in 3.4.3; fixed in 3.3.10.

  • Apache CXF Reflected XSS in the services listing page via the styleSheetPath

    Affected: fixed in 3.3.8; from 3.4.0, fixed in 3.4.1.

  • By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses.

    Affected: fixed in 3.2.12; from 3.3.0, fixed in 3.3.5.

  • Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be…

    Affected: fixed in 3.2.12; from 3.3.0, fixed in 3.3.5.

  • Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message.

    Affected: fixed in 3.2.11; from 3.3.0, fixed in 3.3.4.

  • It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty("java.protocol.handler.pkgs"…

    Affected: from 3.2.0, fixed in 3.2.5; fixed in 3.1.16.