CVE-2022-46364-Poc

Exploit CVE-2022-46364 Apache CXF SSRF mediante MTOM XOP:Include | CVSS 9.8 CRÍTICO Vulnerabilidad Apache CXF -s -d -t, --target - Endpoint SOAP CXF vulnerable requerido -s, --ssrf-url - URL interna para exfiltrar requerido -d, --domain - Dominio objetivo por defecto: localhost --plain-soap -...

CVE-2024-28752

Apache CXF CVE-2024-28752 Entorno de reproducción Anuncio de vulnerabilidad: https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txt Inicio del entorno samples/javafirstjaxwsfactorybean IDEA Inicie el servicio webservice a través de ServerStarter.java Compilación Usar JDK8 root@kitploi...

CVE-2022-46364---Apache-CXF-XOP-Include-LFI-PoC

Apache CXF XOP Include LFI CVE-2022-46364 Resumen Este repositorio contiene un exploit de Prueba de Concepto PoC para CVE-2022-46364 , una vulnerabilidad de Inclusión de Archivos Locales LFI en Apache CXF. La vulnerabilidad surge debido al manejo inadecuado de los elementos XOP XML-binary Optimiz...

CVE-2022-46364

CVE-2022-46364 — Apache CXF MTOM/XOP SSRF lectura de archivos Exploit de prueba de concepto para CVE-2022-46364 — una vulnerabilidad de falsificación de solicitud del lado del servidor SSRF en el procesamiento de solicitudes MTOM/XOP de Apache CXF. Resumen de la vulnerabilidad CVE-2022-46364 afec...

asf__cxf_CVE-2019-17573_3-2-11

Bem-vindo ao Apache CXF! O Apache CXF é um framework de serviços de código aberto. O CXF ajuda você a construir e desenvolver serviços usando APIs de programação frontend, como JAX-WS e JAX-RS. Esses serviços podem falar uma variedade de protocolos, como SOAP, XML/HTTP, HTTP RESTful ou CORBA, e...

CVE-2022-46364-poc

CVE-2022-46364 — Apache CXF XOP:Include SSRF / LFI Autore: 0xmid00 Vulnerabilità: SSRF / Lettura file locale tramite XOP:Include nelle richieste MTOM Interessati: Apache CXF 3.5.5 e 3.4.10 Cos'è la Vulnerabilità? Apache CXF elabora messaggi MTOM Message Transmission Optimization Mechanism che...

CVE-2022-46364-Proof-of-the-concept

CVE-2022-46364: Exploit da SSRF a LFI di Apache CXF MTOM XOP:Include ⚠️ DICHIARAZIONE DI NON RESPONSABILITÀ QUESTO STRUMENTO È SOLO PER TEST DI SICUREZZA EDUCATIVI E AUTORIZZATI Questo exploit proof-of-concept è fornito a scopo educativo per aiutare i professionisti della sicurezza a comprendere l...

asf__cxf_CVE-2016-6812_3-0-11

toolchain-integration-tests jdk-cxf-with-toolchain Currently disabled due to https://issues.apache.org/jira/browse/CXF-7714 This project contains sample maven module using cxf-codegen-plugin to generate java from WSDL file. it enforces usage of JDK 1.9 or higher to run the mvn command it configur...

CVE-2026-61466

A flaw was found in Apache CXF. The OAuth2 Dynamic Client Registration endpoint in Apache CXF does not properly validate the scope value provided during client registration. This oversight allows a malicious client to assign itself privileged access scopes, potentially leading to unauthorized...

CVE-2022-46364-htb-ctf

Ferramenta de Exploração SOAP DevArea CVE-2022-46364 Descrição Este exploit especializado tem como alvo o ambiente DevArea no Hack The Box. Ele aproveita uma vulnerabilidade crítica no Apache CXF 3.2.14 CVE-2022-46364 para realizar Inclusão de Arquivo Local LFI e Falsificação de Solicitação do La...

CVE-2026-63687

A flaw was found in Apache CXF. This vulnerability allows an attacker, who has compromised a client's secret, to bypass critical security protections in the authorization process. By injecting malicious values for parameters like codechallenge and nonce, the attacker can undermine the integrity o...

CRLF Injection

Apache CXF is vulnerable to CRLF Injection. The vulnerability is due to unsanitized clientId values from HTTP requests being directly included in OAuth2 server log messages, which allows an attacker to inject arbitrary content or forged log entries into server log files...

Improper Validation Of Specified Type Of Input

Apache CXF is vulnerable to Improper Validation of Specified Type of Input. The vulnerability is due to incomplete validation of untrusted JMS configuration, which allows an attacker who can configure JMS for Apache CXF to inject malicious configuration and potentially execute arbitrary code...

XML External Entity (XXE) Injection

Apache CXF is vulnerable to an XML External Entity XXE injection. The vulnerability is due to insufficient JAXP hardening of SAXParserFactory configurations, which allows an attacker to exploit external entity resolution to perform out-of-band OOB requests and potentially access sensitive resourc...

Authentication Bypass

org.apache.cxf, cxf-rt-rs-security-oauth2 is vulnerable to an Authentication Bypass. The vulnerability is due to a missing throw statement in the security context check, which allows an unauthenticated network attacker to access the /services/oauth2/introspect endpoint and perform token...

Improper Access Control

org.apache.cxf, cxf-rt-rs-security-oauth2 is vulnerable to an improper access control. The vulnerability is due to an inverted IP address validation check that rejects legitimate requests from the bound IP address while allowing requests from other IP addresses, which allows an attacker to bypass...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Buinsess Automation Workflow (CVE-2026-57819, CVE-2026-54225, CVE-2026-64958)

Summary WebSphere Application Server is shipped as a component of IBM Business Automation Workflow. Information about security vulnerabilities affecting IBM WebSphere Application Server Traditional have been published in a security bulletin. Vulnerability Details Refer to the security bulletins...

CVE-2026-66909

A flaw was found in Apache CXF. The Java Message Service JMS transport component improperly deserializes inbound JMS ObjectMessages without type restrictions. A remote attacker can exploit this by sending a specially crafted message to the service's JMS destination. This vulnerability could lead ...

IBM WebSphere Application Server 9.x < 9.0.5.29 / Liberty 17.0.0.3 < 26.0.0.9 (7283567)

The version of IBM WebSphere Application Server running on the remote host is affected by multiple vulnerabilities as referenced in the 7283567 advisory. - An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message...

Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities due to Apache CXF (CVE-2026-57819, CVE-2026-54225, CVE-2026-64958)

Summary There are mulitple vulnerabilities in the Apache CXF library that affect IBM WebSphere Application Server and affect WebSphere Application Server Liberty when the jaxrs-2.0, jaxrs-2.1, jaxws-2.2, xmlWS-3.0, or xmlWS-4.0 features are enabled. Vulnerability Details CVEID:CVE-2026-57819...