GHSA-2P7X-JCR3-7P2C Improper Authentication in Apache CXF

The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending an empty UsernameToken as part of a SOAP request...

GHSA-2G99-C67P-56HM XML Signature/Encryption Not Validated in Apache CXF

Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure that an XML element is signed or encrypted, which has unspecified impact and attack vectors...

GHSA-VJPC-VF4F-82QG Improper Authentication in Apache CXF

Apache CXF 2.4.5 through 2.4.7, 2.5.1 through 2.5.3, and 2.6.x before 2.6.1, does not properly enforce child policies of a WS-SecurityPolicy 1.1 SupportingToken policy on the client side, which allows remote attackers to bypass the 1 AlgorithmSuite, 2 SignedParts, 3 SignedElements, 4...

com.savoirtech.aetos:aetos (>=1.5.6 <=3.0.2.3), io.fabric8.fab.tests:fab-itests (>=1.1.0.Beta1 <=1.2.0.Beta2) +32 more potentially affected by CVE-2017-3156 via org.apache.cxf.karaf:apache-cxf (>=2.7.10 <=3.0.12)

org.apache.cxf.karaf:apache-cxf MAVEN version =2.7.10, =1.5.6, =1.1.0.Beta1, =0.0.1, =0.0.1, =0.0.6, =0.0.1, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.7...

org.apache.cxf.osgi.itests:org.apache.cxf.osgi.itests (>=3.1.0 <=3.1.1) potentially affected by CVE-2017-3156 via org.apache.cxf.karaf:apache-cxf (>=3.1.0 <=3.1.1)

org.apache.cxf.karaf:apache-cxf MAVEN version =3.1.0, =3.1.0, =3.1.1 Source cves: CVE-2017-3156 Source advisory: OSV:GHSA-QC2P-Q7X9-V64P...

com.alibaba:dubbo (>=2.3.0 <=2.5.3), com.apitrary:apitrary-api-client (=0.1) +163 more potentially affected by CVE-2012-5575 via org.apache.cxf:cxf-rt-transports-http (>=2.6.0 <=2.6.6)

org.apache.cxf:cxf-rt-transports-http MAVEN version =2.6.0, =2.3.0, =0.0.2, =1.0.0, =1.0.0, =1.0.3, =1.0.M1, =1.0.M1, =1.0.M2, =1.0.0, =1.2.0 and more Source cves: CVE-2012-5575 Source advisory: OSV:GHSA-7V5V-9V8R-W864...

be.eliwan:eoddata-client (=1.0), br.com.esec.icpm:certillion-client-library (>=1.1.7 <=1.2.0) +279 more potentially affected by CVE-2012-5575 via org.apache.cxf:cxf-rt-transports-http (>=2.7.0 <=2.7.3)

org.apache.cxf:cxf-rt-transports-http MAVEN version =2.7.0, =1.1.7, =1.1.9, =1.2.5, =1.0.3, =1.0.3, =2.0.3, =1.0.0, =0.4.0, =0.4.1, =1.3.1, =1.2.3, =1.2.3, =2.3, =2.12 and more Source cves: CVE-2012-5575 Source advisory: OSV:GHSA-7V5V-9V8R-W864...

Improper Authentication in Apache CXF

The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request...

Covert Timing Channel in Apache CXF

The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks...

Remote web-service operation execution in Apache CXF

Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-service operations by sending a header with a SOAP Action String that is inconsistent with the message body...

Inadequate Encryption Strength in Apache CXF

Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force CXF to use weaker cryptographic...

GHSA-QC2P-Q7X9-V64P Covert Timing Channel in Apache CXF

The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks...

GHSA-55J7-F5WF-43M4 Remote web-service operation execution in Apache CXF

Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-service operations by sending a header with a SOAP Action String that is inconsistent with the message body...

GHSA-XF9F-32GH-H2W4 Improper Authentication in Apache CXF

The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request...

com.github.livesense:org.liveSense.sample.webServiceServlet (>=1.0.3 <=1.0.5), com.github.livesense:org.liveSense.service.cxf (>=1.0.3 <=1.0.5) +224 more potentially affected by CVE-2013-2160 via org.apache.cxf:cxf-rt-frontend-jaxrs (>=2.7.0 <=2.7.3)

org.apache.cxf:cxf-rt-frontend-jaxrs MAVEN version =2.7.0, =1.0.3, =1.0.3, =1.0.0, =0.4.0, =0.4.1, =1.3.1, =1.2.3, =1.2.3, =2.3, =1.0.0, =1.4, =0.9, =2.9.1-SP.10, =1.1.0.Beta1, =1.1.0.Beta6 and more Source cves: CVE-2013-2160 Source advisory: OSV:GHSA-254Q-RP36-V2M8...

cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (=3.1.0.RELEASE), cloud.altemista.fwk.soap:cloud-altemistafwk-core-soap-wss (>=3.0.0.RELEASE <=3.1.0.RELEASE) +927 more potentially affected by CVE-2017-12624 via org.apache.cxf:cxf-core (>=3.1.0 <=3.1.13)

org.apache.cxf:cxf-core MAVEN version =3.1.0, =3.0.0.RELEASE, =3.0.0.RELEASE, =3.0.0.RELEASE, =3.0.0.RELEASE, =3.0.0.RELEASE, =3.0.0.RELEASE, =5.0.0, =1.0.0, =2.3.3, =1.0, =0.2, =0.2, =0.4 - com.github.arucard21.simplyrestful:simplyrestful-spring-boot =0.1 and more Source cves: CVE-2017-12624...

com.argusoft:medplat_core (>=0.0.1 <=0.0.11), com.argusoft:medplat_lms (=0.0.1) +294 more potentially affected by CVE-2016-6812 via org.apache.cxf:cxf-core (>=3.0.0-milestone1 <=3.0.11)

org.apache.cxf:cxf-core MAVEN version =3.0.0-milestone1, =0.0.1, =3.0.1, =0.0.1, =0.6, =0.1.0, =0.1.0, =1.4, =1.6, =2.0.0, =2.0.9, =2.3.16, =1.0.0, =1.0.0, =1.0.0, =2.0.4 and more Source cves: CVE-2016-6812 Source advisory: OSV:GHSA-VW2C-5WPH-V92R...

cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (=3.1.0.RELEASE), cloud.altemista.fwk.soap:cloud-altemistafwk-core-soap-wss (>=3.0.0.RELEASE <=3.1.0.RELEASE) +1253 more potentially affected by CVE-2016-6812 via org.apache.cxf:cxf-core (>=3.1.0 <=3.1.8)

org.apache.cxf:cxf-core MAVEN version =3.1.0, =3.0.0.RELEASE, =3.0.0.RELEASE, =3.0.0.RELEASE, =3.0.0.RELEASE, =3.0.0.RELEASE, =3.0.0.RELEASE, =2.6.3, =1.2.18, =5.0.0, =6.0.1 - com.bilalalp:cxfclientlogger =1.0 - com.bilalalp:cxflogger =1.0 and more Source cves: CVE-2016-6812 Source advisory:...

com.argusoft:medplat_core (>=0.0.1 <=0.0.11), com.argusoft:medplat_lms (=0.0.1) +294 more potentially affected by CVE-2016-8739 via org.apache.cxf:cxf-core (>=3.0.0-milestone1 <=3.0.11)

org.apache.cxf:cxf-core MAVEN version =3.0.0-milestone1, =0.0.1, =3.0.1, =0.0.1, =0.6, =0.1.0, =0.1.0, =1.4, =1.6, =2.0.0, =2.0.9, =2.3.16, =1.0.0, =1.0.0, =1.0.0, =2.0.4 and more Source cves: CVE-2016-8739 Source advisory: OSV:GHSA-X7XF-253V-X3W8...

cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (=3.1.0.RELEASE), cloud.altemista.fwk.soap:cloud-altemistafwk-core-soap-wss (>=3.0.0.RELEASE <=3.1.0.RELEASE) +1253 more potentially affected by CVE-2016-8739 via org.apache.cxf:cxf-core (>=3.1.0 <=3.1.8)

org.apache.cxf:cxf-core MAVEN version =3.1.0, =3.0.0.RELEASE, =3.0.0.RELEASE, =3.0.0.RELEASE, =3.0.0.RELEASE, =3.0.0.RELEASE, =3.0.0.RELEASE, =2.6.3, =1.2.18, =5.0.0, =6.0.1 - com.bilalalp:cxfclientlogger =1.0 - com.bilalalp:cxflogger =1.0 and more Source cves: CVE-2016-8739 Source advisory:...