Improper Input Validation in Apache CXF

Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in Apache ServiceMix, Apache Camel, Apache Chemistry, Apache jUDDI, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send...

com.custardsource.parfait:parfait-cxf (>=0.2.0 <=0.3.9), com.redhat.rhevm.api:rhevm-api-cli-actions (>=0.9-milestone1 <=0.9-milestone-4.4) +60 more potentially affected by CVE-2010-2076 via org.apache.cxf:cxf-rt-frontend-jaxrs (>=2.2.1 <=2.2.8)

org.apache.cxf:cxf-rt-frontend-jaxrs MAVEN version =2.2.1, =0.2.0, =0.9-milestone1, =0.1-milestone, =0.1-milestone, =0.9-milestone1, =0.1-milestone, =0.1-milestone, =0.9-milestone1, =0.9-milestone3, =0.9-milestone1, =0.9-milestone1, =0.9-milestone3, =0.9-milestone1, =0.1-milestone,...

GHSA-V8Q2-94F6-6XQ2 Improper Input Validation in Apache CXF

Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in Apache ServiceMix, Apache Camel, Apache Chemistry, Apache jUDDI, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send...

XML Signature/Encryption Not Validated in Apache CXF

Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure that an XML element is signed or encrypted, which has unspecified impact and attack vectors...

Improper Authentication in Apache CXF

The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending an empty UsernameToken as part of a SOAP request...

GHSA-2P7X-JCR3-7P2C Improper Authentication in Apache CXF

The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending an empty UsernameToken as part of a SOAP request...

GHSA-2G99-C67P-56HM XML Signature/Encryption Not Validated in Apache CXF

Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure that an XML element is signed or encrypted, which has unspecified impact and attack vectors...

GHSA-VJPC-VF4F-82QG Improper Authentication in Apache CXF

Apache CXF 2.4.5 through 2.4.7, 2.5.1 through 2.5.3, and 2.6.x before 2.6.1, does not properly enforce child policies of a WS-SecurityPolicy 1.1 SupportingToken policy on the client side, which allows remote attackers to bypass the 1 AlgorithmSuite, 2 SignedParts, 3 SignedElements, 4...

Improper Authentication in Apache CXF

Apache CXF 2.4.5 through 2.4.7, 2.5.1 through 2.5.3, and 2.6.x before 2.6.1, does not properly enforce child policies of a WS-SecurityPolicy 1.1 SupportingToken policy on the client side, which allows remote attackers to bypass the 1 AlgorithmSuite, 2 SignedParts, 3 SignedElements, 4...

be.eliwan:eoddata-client (=1.0), br.com.esec.icpm:certillion-client-library (>=1.1.7 <=1.2.0) +279 more potentially affected by CVE-2012-5575 via org.apache.cxf:cxf-rt-transports-http (>=2.7.0 <=2.7.3)

org.apache.cxf:cxf-rt-transports-http MAVEN version =2.7.0, =1.1.7, =1.1.9, =1.2.5, =1.0.3, =1.0.3, =2.0.3, =1.0.0, =0.4.0, =0.4.1, =1.3.1, =1.2.3, =1.2.3, =2.3, =2.12 and more Source cves: CVE-2012-5575 Source advisory: OSV:GHSA-7V5V-9V8R-W864...

org.apache.cxf.osgi.itests:org.apache.cxf.osgi.itests (>=3.1.0 <=3.1.1) potentially affected by CVE-2017-3156 via org.apache.cxf.karaf:apache-cxf (>=3.1.0 <=3.1.1)

org.apache.cxf.karaf:apache-cxf MAVEN version =3.1.0, =3.1.0, =3.1.1 Source cves: CVE-2017-3156 Source advisory: OSV:GHSA-QC2P-Q7X9-V64P...

Covert Timing Channel in Apache CXF

The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks...

GHSA-XF9F-32GH-H2W4 Improper Authentication in Apache CXF

The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request...

com.savoirtech.aetos:aetos (>=1.5.6 <=3.0.2.3), io.fabric8.fab.tests:fab-itests (>=1.1.0.Beta1 <=1.2.0.Beta2) +32 more potentially affected by CVE-2017-3156 via org.apache.cxf.karaf:apache-cxf (>=2.7.10 <=3.0.12)

org.apache.cxf.karaf:apache-cxf MAVEN version =2.7.10, =1.5.6, =1.1.0.Beta1, =0.0.1, =0.0.1, =0.0.6, =0.0.1, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.7...

Remote web-service operation execution in Apache CXF

Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-service operations by sending a header with a SOAP Action String that is inconsistent with the message body...

org.apache.camel:camel-cxf (>=2.9.0 <=2.9.0-RC1), org.apache.camel:camel-example-cxf (>=2.9.0 <=2.9.0-RC1) +117 more potentially affected by CVE-2012-5575 via org.apache.cxf:cxf-rt-transports-http (>=2.5.0 <=2.5.1)

org.apache.cxf:cxf-rt-transports-http MAVEN version =2.5.0, =2.9.0, =2.9.0, =2.9.0, =2.9.0, =2.9.0, =2.9.0, =2.9.0, =2.9.0, =2.9.0, =2.9.0, =2.9.0, =2.5.0, =2.5.0, =2.5.0, =2.5.0, =2.5.1 and more Source cves: CVE-2012-5575 Source advisory: OSV:GHSA-7V5V-9V8R-W864...

com.alibaba:dubbo (>=2.3.0 <=2.5.3), com.apitrary:apitrary-api-client (=0.1) +163 more potentially affected by CVE-2012-5575 via org.apache.cxf:cxf-rt-transports-http (>=2.6.0 <=2.6.6)

org.apache.cxf:cxf-rt-transports-http MAVEN version =2.6.0, =2.3.0, =0.0.2, =1.0.0, =1.0.0, =1.0.3, =1.0.M1, =1.0.M1, =1.0.M2, =1.0.0, =1.2.0 and more Source cves: CVE-2012-5575 Source advisory: OSV:GHSA-7V5V-9V8R-W864...

GHSA-55J7-F5WF-43M4 Remote web-service operation execution in Apache CXF

Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-service operations by sending a header with a SOAP Action String that is inconsistent with the message body...

GHSA-QC2P-Q7X9-V64P Covert Timing Channel in Apache CXF

The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks...

Improper Authentication in Apache CXF

The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request...