Apache Axis2 Default Login

Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account, which makes it easier for remote attackers to execute arbitrary code by uploading a crafted web service. id: CVE-2010-02...

Security Bulletin: Deserialization of Untrusted Data in Apache Axis2 affects AS4 of IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-66713)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerability Vulnerability Details CVEID:CVE-2026-66713 DESCRIPTION: Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java...

org.apache.axis2:axis2-integration (1.4), org.apache.camel:camel-example-cxf (1.3.0) +2 more potentially affected by CVE-2026-74761 via org.apache.activemq:apache-activemq (5.0.0)

org.apache.activemq:apache-activemq MAVEN version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.activemq:apache-activemq and may be impacted: - org.apache.axis2:axis2-integration 1.4 - org.apache.camel:camel-example-cxf 1.3.0 -...

org.apache.axis2:axis2-integration (1.4), org.apache.camel:camel-example-cxf (>=1.2.0, <=1.3.0) +3 more potentially affected by CVE-2026-74761 via org.apache.activemq:apache-activemq (>=4.1.1, <=5.0.0)

org.apache.activemq:apache-activemq MAVEN version =4.1.1, =1.2.0, =1.1.0, =1.3.0 - org.apache.camel:camel-example-spring 1.2.0 - org.apache.camel:camel-example-spring-xquery 1.3.0 Source cves: CVE-2026-74761 Source advisory: MEND:CVE-2026-74761...

org.apache.activemq:activemq-web (5.0.0), org.apache.activemq:activemq-web-console (5.0.0) +9 more potentially affected by CVE-2026-47884 via org.springframework:spring-webmvc (2.0.6)

org.springframework:spring-webmvc MAVEN version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.apache.activemq:activemq-web 5.0.0 - org.apache.activemq:activemq-web-console 5.0.0 -...

Insecure Deserialization

Apache Axis2/Java is vulnerable to Insecure Deserialization. The vulnerability is due to deserialization of untrusted data in the Tribes-based clustering component, where crafted serialized Java objects received over the clustering channel can trigger arbitrary code execution by unauthenticated...

Apache Axis2 - xsd Path Traversal Detection

Detects Axis2 service ?xsd=../conf/axis2.xml traversal by matching axisconfig AxisJava2.0 in the response. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Axis2 ?xsd= path traversal to axis2.xml.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

CVE-2026-66713

A flaw was found in Apache Axis2/Java, specifically within its Tribes-based clustering component. When this clustering feature is enabled on Apache Tomcat, an attacker can exploit a vulnerability related to the deserialization of untrusted data. This allows an unauthenticated remote attacker, wit...

org.apache.axis2:axis2-integration (1.4), org.apache.camel:camel-example-cxf (1.3.0) +2 more potentially affected by CVE-2026-59878 via org.apache.activemq:apache-activemq (5.0.0)

org.apache.activemq:apache-activemq MAVEN version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.activemq:apache-activemq and may be impacted: - org.apache.axis2:axis2-integration 1.4 - org.apache.camel:camel-example-cxf 1.3.0 -...

com.uyatu.sdk:uyatu-java-common (>=2.0.0, <=2.0.5), com.uyatu.sdk:uyatu-spring-boot3-starter (>=2.0.0, <=2.1.1) +81 more potentially affected by CVE-2026-66713 via org.apache.axis2:axis2-kernel (2.0.0)

org.apache.axis2:axis2-kernel MAVEN version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.axis2:axis2-kernel and may be impacted: - com.uyatu.sdk:uyatu-java-common =2.0.0, =2.0.0, =1.0.0, =9.7.0-m2, =9.7.0-m2, =9.7.0-m2, =9.7.0-m2,...

Deserialization of Untrusted Data

Overview org.apache.axis2:axis2-kernel is a Web Services / SOAP / WSDL engine, the successor to the widely used Apache Axis SOAP stack. Affected versions of this package are vulnerable to Deserialization of Untrusted Data the Tribes-based clustering channel in...

CVE-2026-66713

Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...

CVE-2026-66713 Apache Axis2/Java: deserialization of untrusted Data

Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...

org.apache.axis2:axis2-integration (>=1.4, <=1.6.3), org.apache.axis2:axis2-webapp (>=1.6.0, <=2.0.0) potentially affected by CVE-2026-66713 via org.apache.axis2:axis2-clustering (>=1.4, <=2.0.0)

org.apache.axis2:axis2-clustering MAVEN version =1.4, =1.4, =1.6.0, =2.0.0 Source cves: CVE-2026-66713 Source advisory: MEND:CVE-2026-66713...

CVE-2026-66713

Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...

CVE-2026-66713

Apache Axis2/Java (versions through 2.0.0 ) is vulnerable to a Deserialization of Untrusted Data (CWE-502) flaw within the Tribes-based clustering component when running on Apache Tomcat . If Tribes clustering is enabled, an unauthenticated remote attacker with network access to the clustering po...

CVE-2026-66713

Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...

CVE-2026-66713 Apache Axis2/Java: deserialization of untrusted Data

Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...

CVE-2026-66713 Apache Axis2/Java: deserialization of untrusted Data

Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...

EUVD-2026-49849

Deserialization of Untrusted Data CWE-502 in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat only when Tribes clustering is enabled, which is off by default allows an unauthenticated remote attacker with network access to the...