Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.cxf:cxf-rt-frontend-jaxrs

5 known vulnerabilities (1 high), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
5 · 1 high
Dependents
197
Registry
Maven Central

Advisories 5

  • Apache CXF: No default restriction on the amount of form parameters per message

    Affected: from 4.2.0, fixed in 4.2.3; from 4.0.0, fixed in 4.1.8; fixed in 3.6.12.

  • The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before 3.0.1 allows remote attackers to cause a denial…

    Affected: from 2.5.0, fixed in 2.6.11; from 2.7.0, fixed in 2.7.8; from 3.0.0, fixed in 3.0.1.

  • The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a…

    Affected: from 2.5.0, fixed in 2.5.10; from 2.6.0, fixed in 2.6.7; from 2.7.0, fixed in 2.7.4.

  • Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows…

    Affected: fixed in 2.5.9; from 2.6.0, fixed in 2.6.6; from 2.7.0, fixed in 2.7.3.

  • Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in Apache ServiceMix, Apache Camel, Apache Chemistry…

    Affected: from 2.0.0, fixed in 2.0.13; from 2.1.0, fixed in 2.1.10; from 2.2.0, fixed in 2.2.9.