com.eurodyn.qlack2.util:qlack2-util-apache-santuario-fragment (>=2.3.3 <=2.3.19), com.eurodyn.qlack2.util:qlack2-util-sso (>=2.3.3 <=2.3.19) +10 more potentially affected by CVE-2015-5253 via org.apache.cxf:cxf-rt-rs-security-sso-saml (>=3.1.0 <=3.1.2)

org.apache.cxf:cxf-rt-rs-security-sso-saml MAVEN version =3.1.0, =2.3.3, =2.3.3, =1.3.2, =1.4.0, =1.3.2, =1.4.0, =3.1.0, =3.1.0, =2.0.3, =2.0.3, =5.2.0-RC1, =5.2.0-RC3 Source cves: CVE-2015-5253 Source advisory: OSV:GHSA-3336-H95J-HVVF...

Loop with Unreachable Exit Condition in Apache CXF

The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before 3.0.1 allows remote attackers to cause a denial of service infinite loop via a crafted SAML token in the authorization header of a request to a JAX-RS service...

Improper Authentication in Apache WSS4J

Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecifi...

GHSA-5XF9-3V63-WW6F Uncontrolled Resource Consumption in Apache CXF

Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service /tmp disk consumption via a large invalid SOAP message...

GHSA-7VGJ-8MW4-HG8R Improper Input Validation in Apache CXF

Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications. It is possible to craft a message attachment header that could lead to a Denial of Service DoS attack on a CXF web service provider. Both JAX-WS and JAX-RS services are vulnerable to this attack...

GHSA-V45R-RJ5X-HPG2 Cleartext Transmission of Sensitive Information in Apache CXF

The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken, transmits the UsernameToken in cleartext, which allows remote attackers to obtain sensitive information by sniffing th...

GHSA-38X2-FP9M-87MX Improper Input Validation in Apache CXF

The SecurityTokenService STS in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not properly validate SAML tokens when caching is enabled, which allows remote attackers to gain access via an invalid SAML token...

com.argusoft:medplat_core (>=0.0.1 <=0.0.11), com.argusoft:medplat_lms (=0.0.1) +63 more potentially affected by CVE-2014-3584 via org.apache.cxf:cxf-rt-frontend-jaxrs (=3.0.0)

org.apache.cxf:cxf-rt-frontend-jaxrs MAVEN version =3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-frontend-jaxrs and may be impacted: - com.argusoft:medplatcore =0.0.1, =0.1.0, =0.1.0, =0.0.6, =0.0.6, =0.0.6, =0.0.6, =0.0....

cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (=3.1.0.RELEASE), cloud.altemista.fwk.soap:cloud-altemistafwk-core-soap-wss (>=3.0.0.RELEASE <=3.1.0.RELEASE) +927 more potentially affected by CVE-2017-12624 via org.apache.cxf:cxf-core (>=3.1.0 <=3.1.13)

org.apache.cxf:cxf-core MAVEN version =3.1.0, =3.0.0.RELEASE, =3.0.0.RELEASE, =3.0.0.RELEASE, =3.0.0.RELEASE, =3.0.0.RELEASE, =3.0.0.RELEASE, =5.0.0, =1.0.0, =2.3.3, =1.0, =0.2, =0.2, =0.4 - com.github.arucard21.simplyrestful:simplyrestful-spring-boot =0.1 and more Source cves: CVE-2017-12624...

ai.idylnlp:idylnlp-nlp-language-detection-tika (>=1.0.0 <=1.1.0), com.alibaba:dubbo (>=2.5.4 <=2.6.0) +427 more potentially affected by CVE-2017-12624 via org.apache.cxf:cxf-core (>=3.0.0-milestone1 <=3.0.15)

org.apache.cxf:cxf-core MAVEN version =3.0.0-milestone1, =1.0.0, =2.5.4, =2.6.1, =5.4.2, =5.3.0, =0.0.1, =3.0.1, =3.1.2, =0.0.1, =0.6, =0.8 and more Source cves: CVE-2017-12624 Source advisory: OSV:GHSA-7VGJ-8MW4-HG8R...

com.github.arucard21.simplyrestful:simplyrestful-jetty (=0.5), com.github.arucard21.simplyrestful:simplyrestful-spring-boot (=0.2) +216 more potentially affected by CVE-2017-12624 via org.apache.cxf:cxf-core (=3.2.0)

org.apache.cxf:cxf-core MAVEN version =3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-core and may be impacted: - com.github.arucard21.simplyrestful:simplyrestful-jetty =0.5 -...

br.com.esec.icpm:certillion-client-library (>=1.1.7 <=1.2.0), br.com.esec.icpm:certillion-client-library-resteasy-plugin (>=1.1.9 <=1.1.10) +59 more potentially affected by CVE-2014-0034 via org.apache.cxf:cxf-rt-ws-security (>=2.7.0 <=2.7.8)

org.apache.cxf:cxf-rt-ws-security MAVEN version =2.7.0, =1.1.7, =1.1.9, =1.2.5, =1.0, =0.6.49, =0.6.49, =1.0.1, =1.0.0, =1.0.0, =1.1, =2.11.0, =2.13.4 and more Source cves: CVE-2014-0034 Source advisory: OSV:GHSA-38X2-FP9M-87MX...

org.apache.cxf.fediz.systests.federation:fediz-systests-federation-samlIdpWebapp (>=1.2.0 <=1.2.4), org.apache.cxf.fediz:fediz-idp (>=1.2.0 <=1.2.4) +2 more potentially affected by CVE-2015-5253 via org.apache.cxf:cxf-rt-rs-security-sso-saml (>=3.0.0 <=3.0.6)

org.apache.cxf:cxf-rt-rs-security-sso-saml MAVEN version =3.0.0, =1.2.0, =1.2.0, =3.0.5, =3.0.0, =3.0.16 Source cves: CVE-2015-5253 Source advisory: OSV:GHSA-3336-H95J-HVVF...

com.apitrary:apitrary-api-client (=0.1), com.apitrary:apitrary-orm-core (=0.1) +95 more potentially affected by CVE-2013-2160 via org.apache.cxf:cxf-rt-frontend-jaxrs (>=2.6.0 <=2.6.6)

org.apache.cxf:cxf-rt-frontend-jaxrs MAVEN version =2.6.0, =0.0.2, =1.0.0, =1.0.0, =1.0.3, =1.0.M1, =1.0.M1, =1.0.M2, =1.0.0, =1.0.0, =1.0.6 and more Source cves: CVE-2013-2160 Source advisory: OSV:GHSA-254Q-RP36-V2M8...

Improper Restriction of XML External Entity Reference in Apache CXF JAX-RS

The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides a number of Atom JAX-RS MessageBodyReaders. These readers use Apache Abdera Parser which expands XML entities by default which represents a major XXE risk...

Improper Neutralization of Input During Web Page Generation in Apache CXF

The HTTP transport module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 uses FormattedServiceListWriter to provide an HTML page which lists the names and absolute URL addresses of the available service endpoints. The module calculates the base URL using the current HttpServletRequest. Th...

GHSA-X7XF-253V-X3W8 Improper Restriction of XML External Entity Reference in Apache CXF JAX-RS

The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides a number of Atom JAX-RS MessageBodyReaders. These readers use Apache Abdera Parser which expands XML entities by default which represents a major XXE risk...

GHSA-99V3-9X35-C5VF Improper Authentication in Apache WSS4J

Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecifi...

GHSA-254Q-RP36-V2M8 Missing XML Validation in Apache CXF

The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service CPU and memory consumption via crafted XML with a large number of 1 elements, 2 attributes, 3 nested constructs, and possibly other vectors...

ai.idylnlp:idylnlp-nlp-language-detection-tika (>=1.0.0 <=1.1.0), com.argusoft:medplat_core (>=0.0.1 <=0.0.11) +412 more potentially affected by CVE-2017-5653 via org.apache.cxf:cxf-core (>=3.0.0-milestone1 <=3.0.12)

org.apache.cxf:cxf-core MAVEN version =3.0.0-milestone1, =1.0.0, =0.0.1, =3.0.1, =3.1.2, =0.0.1, =0.6, =0.1.0, =0.1.0, =1.1.0 and more Source cves: CVE-2017-5653 Source advisory: OSV:GHSA-HGG6-8X62-M9GF...