Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.cxf:cxf

12 known vulnerabilities, with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
12
Registry
Maven Central

Advisories 12

  • Apache CXF Denial of service vulnerability in parsing JSON via JsonMapObjectReaderWriter

    Affected: from 3.4.0, fixed in 3.4.4; fixed in 3.3.11.

  • OAuth 2 authorization service vulnerable to DDos attacks

    Affected: from 3.4.0, fixed in 3.4.3; fixed in 3.3.10.

  • Apache CXF Reflected XSS in the services listing page via the styleSheetPath

    Affected: fixed in 3.3.8; from 3.4.0, fixed in 3.4.1.

  • By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses.

    Affected: fixed in 3.2.12; from 3.3.0, fixed in 3.3.5.

  • Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be…

    Affected: fixed in 3.2.12; from 3.3.0, fixed in 3.3.5.

  • Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service.

    Affected: fixed in 3.2.11; from 3.3.0, fixed in 3.3.4.

  • Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message.

    Affected: fixed in 3.2.11; from 3.3.0, fixed in 3.3.4.

  • The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending an empty…

    Affected: from 2.4.0, fixed in 2.4.6; from 2.5.0, fixed in 2.5.2.

  • The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor…

    Affected: fixed in 2.5.8; from 2.6.0, fixed in 2.6.5; from 2.7.0, fixed in 2.7.2.

  • Apache CXF 2.4.5 through 2.4.7, 2.5.1 through 2.5.3, and 2.6.x before 2.6.1, does not properly enforce child policies of a…

    Affected: from 2.4.5, fixed in 2.4.8; from 2.5.1, fixed in 2.5.3; from 2.6.0, fixed in 2.6.1.

  • Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1…

    Affected: from 2.4.0, fixed in 2.4.8; from 2.5.0, fixed in 2.5.4; from 2.6.0, fixed in 2.6.1.

  • Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-service operations…

    Affected: fixed in 2.4.9; from 2.5.0, fixed in 2.5.5; from 2.6.0, fixed in 2.6.2.