com.domeke:basecore (>=1.0.0 <=1.0.4), com.eurodyn.qlack2.fuse:qlack2-fuse-workflow-runtime-impl (>=2.3.3 <=2.3.19) +408 more potentially affected by CVE-2017-5653 via org.apache.cxf:cxf-core (>=3.1.0 <=3.1.10)

org.apache.cxf:cxf-core MAVEN version =3.1.0, =1.0.0, =2.3.3, =1.0, =0.2, =0.2, =1.1.4-rc1, =1.0.1, =1.1.0.0, =1.1.0.0, =1.5.8.0 - com.reallifedeveloper:rld-common =1.3 - com.wichell:framework-config =1.0.0 - com.wichell:framework-core =1.0.0 - com.wichell:framework-dao =1.0.0 and more Source cve...

ai.idylnlp:idylnlp-nlp-language-detection-tika (>=1.0.0 <=1.1.0), com.argusoft:medplat_core (>=0.0.1 <=0.0.11) +412 more potentially affected by CVE-2017-5656 via org.apache.cxf:cxf-core (>=3.0.0-milestone1 <=3.0.12)

org.apache.cxf:cxf-core MAVEN version =3.0.0-milestone1, =1.0.0, =0.0.1, =3.0.1, =3.1.2, =0.0.1, =0.6, =0.1.0, =0.1.0, =1.1.0 and more Source cves: CVE-2017-5656 Source advisory: OSV:GHSA-V936-X3J5-C76J...

GHSA-F5CH-36RG-VFCC Cross-Site Request Forgery in Apache CXF Fediz

Apache CXF Fediz ships with an OpenId Connect OIDC service which has a Client Registration Service, which is a simple web application that allows clients to be created, deleted, etc. A CSRF Cross Style Request Forgery style vulnerability has been found in this web application in Apache CXF Fediz...

Improper Certificate Validation in Apache CXF

JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remote attackers to spoof servers...

Session Fixation in Apache CXF

Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker could craft a token which would return an identifer corresponding to a cached token for another user...

Cross-Site Request Forgery in Apache CXF Fediz

Apache CXF Fediz ships with an OpenId Connect OIDC service which has a Client Registration Service, which is a simple web application that allows clients to be created, deleted, etc. A CSRF Cross Style Request Forgery style vulnerability has been found in this web application in Apache CXF Fediz...

com.domeke:basecore (>=1.0.0 <=1.0.4), com.eurodyn.qlack2.fuse:qlack2-fuse-workflow-runtime-impl (>=2.3.3 <=2.3.19) +408 more potentially affected by CVE-2017-5656 via org.apache.cxf:cxf-core (>=3.1.0 <=3.1.10)

org.apache.cxf:cxf-core MAVEN version =3.1.0, =1.0.0, =2.3.3, =1.0, =0.2, =0.2, =1.1.4-rc1, =1.0.1, =1.1.0.0, =1.1.0.0, =1.5.8.0 - com.reallifedeveloper:rld-common =1.3 - com.wichell:framework-config =1.0.0 - com.wichell:framework-core =1.0.0 - com.wichell:framework-dao =1.0.0 and more Source cve...

GHSA-V936-X3J5-C76J Session Fixation in Apache CXF

Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker could craft a token which would return an identifer corresponding to a cached token for another user...

br.com.esec.icpm:certillion-client-library (>=1.1.7 <=1.2.0), br.com.esec.icpm:certillion-client-library-resteasy-plugin (>=1.1.9 <=1.1.10) +294 more potentially affected by CVE-2013-2172 via org.apache.santuario:xmlsec (>=1.5.1 <=1.5.4)

org.apache.santuario:xmlsec MAVEN version =1.5.1, =1.1.7, =1.1.9, =1.2.5, =1.0, =ec2-2013-02-01 and more Source cves: CVE-2013-2172 Source advisory: OSV:GHSA-R237-W2W6-JQ3P...

ai.platon.pulsar:pulsar-persist (>=1.9.0 <=1.10.23), com.argonio.gora:gora-accumulo (>=0.5 <=0.5.1) +148 more potentially affected by CVE-2013-0239 via org.apache.cxf:cxf-rt-frontend-jaxrs (>=2.1 <=2.5.8)

org.apache.cxf:cxf-rt-frontend-jaxrs MAVEN version =2.1, =1.9.0, =0.5, =0.5, =0.5, =0.5, =0.5, =0.5, =0.5, =4.0.0, =0.2.0, =1.0.2, =1.0.0, =1.0.0-beta-2 - com.meschbach.psi:salutator =2.4 and more Source cves: CVE-2013-0239 Source advisory: OSV:GHSA-P5C5-6564-VVR8...

com.github.livesense:org.liveSense.sample.webServiceServlet (>=1.0.3 <=1.0.5), com.github.livesense:org.liveSense.service.cxf (>=1.0.3 <=1.0.5) +195 more potentially affected by CVE-2013-0239 via org.apache.cxf:cxf-rt-frontend-jaxrs (>=2.7.0 <=2.7.2)

org.apache.cxf:cxf-rt-frontend-jaxrs MAVEN version =2.7.0, =1.0.3, =1.0.3, =1.0.0, =0.4.0, =0.4.1, =2.3, =1.3.1, =1.4, =0.9, =2.9.1-SP.10, =1.1.0.Beta1, =1.1.0.Beta1, =1.1.0.Beta1, =1.1.0.Beta1, =1.2.0.Beta4 and more Source cves: CVE-2013-0239 Source advisory: OSV:GHSA-P5C5-6564-VVR8...

com.apitrary:apitrary-api-client (=0.1), com.apitrary:apitrary-orm-core (=0.1) +88 more potentially affected by CVE-2013-0239 via org.apache.cxf:cxf-rt-frontend-jaxrs (>=2.6.0 <=2.6.5)

org.apache.cxf:cxf-rt-frontend-jaxrs MAVEN version =2.6.0, =0.0.2, =1.0.0, =1.0.0, =1.0.3, =1.0.M1, =1.0.M1, =1.0.M2, =1.0.0, =1.0.0, =1.0.6 and more Source cves: CVE-2013-0239 Source advisory: OSV:GHSA-P5C5-6564-VVR8...

GHSA-P5C5-6564-VVR8 Improper Authentication in Apache CXF

Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element...

Improper Authentication in Apache CXF

Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element...

org.apache.camel:camel-xmlsecurity (>=2.0-M1 <=2.5.0), org.apache.cxf.dosgi.samples:cxf-dosgi-ri-samples-greeter-client (=1.0) +71 more potentially affected by CVE-2009-0217 via org.apache.santuario:xmlsec (=1.4.2)

org.apache.santuario:xmlsec MAVEN version =1.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.santuario:xmlsec and may be impacted: - org.apache.camel:camel-xmlsecurity =2.0-M1, =2.0.10, =2.0.10, =2.0.10, =2.0.10, =2.0.10, =2.0.10, =2.2.2...

Security Bulletin: Security vulnerability in Apache affects IBM InfoSphere Master Data Management (CVE-2017-12624)

Summary IBM InfoSphere Master Data Management is vulnerable to an Apache CXF denial of service which could allow a remote attacker to to cause the AX-WS and JAX-RS services to stop responding. Vulnerability Details CVEID: CVE-2017-12624 DESCRIPTION: Apache CXF is vulnerable to a denial of service...

CVE-2021-22696

CXF supports via JwtRequestCodeFilter passing OAuth 2 parameters via a JWT token as opposed to query parameters see: The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request JAR. Instead of sending a JWT token as a "request" parameter, the spec also supports specifying a URI from...

Security Bulletin: Vulnerabilities in IBM WebSphere Application Server Liberty affect BM Spectrum Control (CVE-2019-17573, CVE-2019-12406)

Summary IBM WebSphere Application Server Liberty is vulnerable to Apache CXF cross-site scripting and denial of service . These vulnerabilities affect IBM Spectrum Control. Vulnerability Details CVEID: CVE-2019-17573 DESCRIPTION: Apache CXF is vulnerable to cross-site scripting, caused by imprope...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.10.3 bug fix and security update

Red Hat OpenShift Container Platform release 4.10.3 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.10. Red Hat Product Security has rated this update as having a...

Security Bulletin: Multiple vulnerabilities in WebSphere Application Server affect IBM Spectrum Control (formerly Tivoli Storage Productivity Center) (CVE-2018-1683, CVE-2018-8039)

Summary WebSphere Application Server is vulnerable to possible man-in-the-middle attacks. This is caused by the failure to encrypt ORB communication or by an Apache CXF vulnerability. Vulnerability Details CVEID: CVE-2018-1683 DESCRIPTION: IBM WebSphere Application Server Liberty could allow a...