com.treelogic-swe:aws-mock (=1.0), com.treelogic-swe:cxf-stub (=ec2-2013-02-01) potentially affected by CVE-2021-22696 via org.apache.cxf:apache-cxf (=2.7.5)

org.apache.cxf:apache-cxf MAVEN version =2.7.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:apache-cxf and may be impacted: - com.treelogic-swe:aws-mock =1.0 - com.treelogic-swe:cxf-stub =ec2-2013-02-01 Source cves: CVE-2021-22696...

GHSA-7Q4H-PJ78-J7VG Authorization service vulnerable to DDos attacks in Apache CFX

CXF supports via JwtRequestCodeFilter passing OAuth 2 parameters via a JWT token as opposed to query parameters see: The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request JAR. Instead of sending a JWT token as a "request" parameter, the spec also supports specifying a URI from...

org.odata4j:odata4j-cxf (>=0.6.0 <=0.7.0), org.odata4j:odata4j-dist (>=0.6.0 <=0.7.0) +2 more potentially affected by CVE-2016-11024 via org.odata4j:odata4j-core (>=0.6.0 <=0.7.0)

org.odata4j:odata4j-core MAVEN version =0.6.0, =0.6.0, =0.6.0, =0.6.0, =0.7.0 Source cves: CVE-2016-11024 Source advisory: OSV:GHSA-F96G-24CG-F24W...

com.kumuluz.ee:kumuluzee-jax-ws-cxf (>=2.6.0 <=3.12.2), net.kieker-monitoring:analysis (>=2.0.0 <=2.0.3) +1 more potentially affected by CVE-2020-13954 via org.apache.cxf:cxf (>=2.7.18 <=3.2.6)

org.apache.cxf:cxf MAVEN version =2.7.18, =2.6.0, =2.0.0, =2.0.3 - org.apache.nutch:nutch =1.10 Source cves: CVE-2020-13954 Source advisory: OSV:GHSA-64X2-GQ24-75PV...

Cross-site scripting in Apache CXF

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting XSS attack via the styleSheetPath, which allows a malicious actor to inject javascript into the web page. This...

com.treelogic-swe:aws-mock (=1.0), com.treelogic-swe:cxf-stub (=ec2-2013-02-01) potentially affected by CVE-2020-13954 via org.apache.cxf:apache-cxf (=2.7.5)

org.apache.cxf:apache-cxf MAVEN version =2.7.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:apache-cxf and may be impacted: - com.treelogic-swe:aws-mock =1.0 - com.treelogic-swe:cxf-stub =ec2-2013-02-01 Source cves: CVE-2020-13954...

GHSA-64X2-GQ24-75PV Cross-site scripting in Apache CXF

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting XSS attack via the styleSheetPath, which allows a malicious actor to inject javascript into the web page. This...

Apache CXF Resource Management Error Vulnerability

Apache CXF is the United States Apache Apache Foundation of an open source Web services framework. The framework supports a variety of Web services standards , a variety of front-end programming APIs. Apache CXF has a security vulnerability that can be exploited by attackers DDos attacks...

Security Bulletin: Multiple Apache CXF vulnerabilities identified in IBM Tivoli Application Dependency Discovery Manager.

Summary This security bulletin addresses the vulnerabilities in Open Source Apache CXF that affect IBM Tivoli Application Dependency Discovery Manager. Vulnerability Details CVEID: CVE-2019-12423 DESCRIPTION: Apache CXF could allow a remote attacker to obtain sensitive information, caused by a fl...

Security Bulletin: Apache CXF (Publicly disclosed vulnerability)

Summary Vulnerabilities in Open Source Apache CXF affect IBM Tivoli Application Dependency Discovery Manager Vulnerability Details CVEID: CVE-2019-12419 DESCRIPTION: Apache CXF could allow a remote attacker to bypass security restrictions, caused by the failure to validate that the authenticated...

Security Bulletin: Vulnerability in Apache CXF affects WebSphere Application Server (CVE-2019-12406)

Summary There is a denial of service in the Apache CXF library used by WebSphere Application Server. This has been addressed. Vulnerability Details CVEID: CVE-2019-12406 DESCRIPTION: Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message...

CVE-2021-22696

CXF supports via JwtRequestCodeFilter passing OAuth 2 parameters via a JWT token as opposed to query parameters see: The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request JAR. Instead of sending a JWT token as a "request" parameter, the spec also supports specifying a URI from...

CVE-2021-22696

CXF supports via JwtRequestCodeFilter passing OAuth 2 parameters via a JWT token as opposed to query parameters see: The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request JAR. Instead of sending a JWT token as a "request" parameter, the spec also supports specifying a URI from...

Authorization

CXF supports via JwtRequestCodeFilter passing OAuth 2 parameters via a JWT token as opposed to query parameters see: The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request JAR. Instead of sending a JWT token as a "request" parameter, the spec also supports specifying a URI from...

CVE-2021-22696

CVE-2021-22696 affects Apache CXF where improper validation of the request_uri parameter in OAuth 2 flows allows a remote attacker to cause a denial of service on the authorization server. The issue occurs when a JWT-based request uses a request_uri to fetch the token, with insufficient validatio...

CVE-2021-22696 OAuth 2 authorization service vulnerable to DDos attacks

CXF supports via JwtRequestCodeFilter passing OAuth 2 parameters via a JWT token as opposed to query parameters see: The OAuth 2.0 Authorization Framework: JWT Secured Authorization Request JAR. Instead of sending a JWT token as a "request" parameter, the spec also supports specifying a URI from...

Apache CXF 代码问题漏洞

Apache CXF is the United States Apache Apache Foundation of an open source Web services framework. The framework supports a variety of Web services standards , a variety of front-end programming APIs. Apache CXF has a security vulnerability that can be exploited by attackers DDos attacks...

Security Bulletin: A security vulnerability has been identified in Apache CXF, which is a required product for IBM Tivoli Network Manager IP Edition (CVE-2020-13954)

Summary A security vulnerability has been disclosed in the Apache CXF library , which is installed as part of IBM Tivoli Network Manager version 4.2. Information about this vulnerability has been published in a security bulletin. Vulnerability Details CVEID: CVE-2020-13954 DESCRIPTION: Apache CXF...

Security Bulletin: IBM Security Guardium is affected by an "Apache CXF" jar vulnerability

Summary IBM Security Guardium has fixed this vulnerability Vulnerability Details CVEID: CVE-2017-12624 DESCRIPTION: Apache CXF is vulnerable to a denial of service. By using a specially crafted message attachment header, a remote attacker could exploit this vulnerability to cause the AX-WS and...

Security Bulletin: Vulnerability in Apache CXF library shipped with IBM Global Mailbox (CVE-2020-13954)

Summary Security vulnerability have been Identified In Apache CXF library shipped with IBM Global Mailbox. Vulnerability Details CVEID: CVE-2020-13954 DESCRIPTION: Apache CXF is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the services listing page. ...