CVE-2022-46364-Poc

CVE-2022-46364 Exploit Apache CXF SSRF tramite MTOM XOP:Include | CVSS 9.8 CRITICO Vulnerabilità Apache CXF -s -d -t, --target - Endpoint SOAP CXF vulnerabile obbligatorio -s, --ssrf-url - URL interno da esfiltrare obbligatorio -d, --domain - Dominio di destinazione predefinito: localhost...

CVE-2024-28752

Apache CXF CVE-2024-28752 Reproduktionsumgebung Sicherheitshinweis: https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txt Umgebungsstart samples/javafirstjaxwsfactorybean IDEA Starten Sie den Webservice mit ServerStarter.java Build Verwenden Sie JDK8 root@kitploit: mvn clean package...

CVE-2022-46364---Apache-CXF-XOP-Include-LFI-PoC

Apache CXF XOP Include LFI CVE-2022-46364 Übersicht Dieses Repository enthält einen Proof-of-Concept PoC-Exploit für CVE-2022-46364 , eine Local File Inclusion LFI-Sicherheitslücke in Apache CXF. Die Sicherheitslücke entsteht durch unsachgemäße Handhabung von XOP XML-binary Optimized Packaging...

CVE-2022-46364-Proof-of-the-concept

CVE-2022-46364: Apache CXF MTOM XOP:Include SSRF zu LFI Exploit ⚠️ HAFTUNGSAUSSCHLUSS DIESES WERKZEUG IST NUR FÜR BILDUNGSZWECKE UND AUTORISIERTE SICHERHEITSTESTS GEEIGNET Dieser Proof-of-Concept-Exploit wird zu Bildungszwecken bereitgestellt, um Sicherheitsexperten zu helfen, die Schwachstelle zu...

CVE-2022-46364-htb-ctf

Strumento di Sfruttamento SOAP per DevArea CVE-2022-46364 Descrizione Questo exploit specializzato ha come bersaglio l'ambiente DevArea su Hack The Box. Sfrutta una vulnerabilità critica in Apache CXF 3.2.14 CVE-2022-46364 per eseguire Local File Inclusion LFI e Server-Side Request Forgery SSRF. ...

CVE-2022-46364-poc

CVE-2022-46364 — Apache CXF XOP:Include SSRF / LFI Autore: 0xmid00 Vulnerabilità: SSRF / Lettura file locale tramite XOP:Include nelle richieste MTOM Interessati: Apache CXF 3.5.5 e 3.4.10 Cos'è la Vulnerabilità? Apache CXF elabora messaggi MTOM Message Transmission Optimization Mechanism che...

CVE-2022-46364

CVE-2022-46364 — Apache CXF MTOM/XOP SSRF Lettura File Exploit proof-of-concept per CVE-2022-46364 — una vulnerabilità di server-side request forgery SSRF in Apache CXF nell'elaborazione delle richieste MTOM/XOP. Riepilogo della vulnerabilità CVE-2022-46364 riguarda le versioni di Apache CXF...

asf__cxf_CVE-2016-6812_3-0-11

Willkommen bei Apache CXF! Apache CXF ist ein Open‑Source‑Service‑Framework. CXF hilft Ihnen, Services mit Frontend‑Programmier‑APIs wie JAX‑WS und JAX‑RS zu erstellen und zu entwickeln. Diese Services können eine Vielzahl von Protokollen wie SOAP, XML/HTTP, RESTful HTTP oder CORBA sprechen und...

asf__cxf_CVE-2019-17573_3-2-11

Willkommen bei Apache CXF! Apache CXF ist ein Open-Source-Dienstleistungsframework. CXF hilft Ihnen, Dienste mit Frontend-Programmierschnittstellen wie JAX-WS und JAX-RS zu erstellen und zu entwickeln. Diese Dienste können eine Vielzahl von Protokollen wie SOAP, XML/HTTP, RESTful HTTP oder CORBA...

CRLF Injection

Apache CXF is vulnerable to CRLF Injection. The vulnerability is due to unsanitized clientId values from HTTP requests being directly included in OAuth2 server log messages, which allows an attacker to inject arbitrary content or forged log entries into server log files...

Improper Validation Of Specified Type Of Input

Apache CXF is vulnerable to Improper Validation of Specified Type of Input. The vulnerability is due to incomplete validation of untrusted JMS configuration, which allows an attacker who can configure JMS for Apache CXF to inject malicious configuration and potentially execute arbitrary code...

XML External Entity (XXE) Injection

Apache CXF is vulnerable to an XML External Entity XXE injection. The vulnerability is due to insufficient JAXP hardening of SAXParserFactory configurations, which allows an attacker to exploit external entity resolution to perform out-of-band OOB requests and potentially access sensitive resourc...

Authentication Bypass

org.apache.cxf, cxf-rt-rs-security-oauth2 is vulnerable to an Authentication Bypass. The vulnerability is due to a missing throw statement in the security context check, which allows an unauthenticated network attacker to access the /services/oauth2/introspect endpoint and perform token...

Improper Access Control

org.apache.cxf, cxf-rt-rs-security-oauth2 is vulnerable to an improper access control. The vulnerability is due to an inverted IP address validation check that rejects legitimate requests from the bound IP address while allowing requests from other IP addresses, which allows an attacker to bypass...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Buinsess Automation Workflow (CVE-2026-57819, CVE-2026-54225, CVE-2026-64958)

Summary WebSphere Application Server is shipped as a component of IBM Business Automation Workflow. Information about security vulnerabilities affecting IBM WebSphere Application Server Traditional have been published in a security bulletin. Vulnerability Details Refer to the security bulletins...

CVE-2026-66909

A flaw was found in Apache CXF. The Java Message Service JMS transport component improperly deserializes inbound JMS ObjectMessages without type restrictions. A remote attacker can exploit this by sending a specially crafted message to the service's JMS destination. This vulnerability could lead ...

IBM WebSphere Application Server 9.x < 9.0.5.29 / Liberty 17.0.0.3 < 26.0.0.9 (7283567)

The version of IBM WebSphere Application Server running on the remote host is affected by multiple vulnerabilities as referenced in the 7283567 advisory. - An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message...

Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities due to Apache CXF (CVE-2026-57819, CVE-2026-54225, CVE-2026-64958)

Summary There are mulitple vulnerabilities in the Apache CXF library that affect IBM WebSphere Application Server and affect WebSphere Application Server Liberty when the jaxrs-2.0, jaxrs-2.1, jaxws-2.2, xmlWS-3.0, or xmlWS-4.0 features are enabled. Vulnerability Details CVEID:CVE-2026-57819...

CVE-2026-44618

A flaw was found in Apache CXF. An insecure XML parser configuration within Apache CXF's WS-Transfer module may allow a remote attacker to perform XML External Entity XXE attacks. This could lead to information disclosure, denial of service, or server-side request forgery. Mitigation If using...

CVE-2026-57817

A flaw was found in Apache CXF. When operating in the OpenID Connect Hybrid Flow, Apache CXF does not enforce the validation of the chash parameter. This vulnerability allows a remote attacker, through a non-compliant or misconfigured Identity Provider IdP, to perform Authorization Code...