Security Bulletin: Vulnerabilities found in cxf-rt-transports-http-3.0.3.jar which is shipped with IBM® Intelligent Operations Center(CVE-2016-6812, CVE-2018-8039, CVE-2020-13954)

Summary Multiple vulnerabilities have been identified in cxf-rt-transports-http-3.0.3.jarr which is shipped with IBM® Intelligent Operations Center. Information about these vulnerabilities affecting IBM® Intelligent Operations Center have been published and addressed the applicable CVEs...

com.kumuluz.ee:kumuluzee-jax-ws-cxf (>=2.6.0, <=3.12.2), org.apache.nutch:nutch (1.10) potentially affected by CVE-2020-13954 via org.apache.cxf:cxf (>=3.0.4, <=3.2.14)

org.apache.cxf:cxf MAVEN version =3.0.4, =2.6.0, =3.12.2 - org.apache.nutch:nutch 1.10 Source cves: CVE-2020-13954 Source advisory: GHSA-64X2-GQ24-75PV...

Security Bulletin: A security vulnerability has been identified in Apache CXF, which is a required product for IBM Tivoli Network Manager IP Edition (CVE-2020-13954)

Summary A security vulnerability has been disclosed in the Apache CXF library , which is installed as part of IBM Tivoli Network Manager version 4.2. Information about this vulnerability has been published in a security bulletin. Vulnerability Details CVEID: CVE-2020-13954 DESCRIPTION: Apache CXF...

CVE-2020-13954

CVE-2020-13954 is an Apache CXF cross-site scripting (XSS) vulnerability exposed via the /services listing page. The issue arises from improper validation of user-supplied input through styleSheetPath, enabling an attacker to inject script when the URL is visited. Public documentation in the init...

CVE-2020-13954 Apache CXF Reflected XSS in the services listing page via the styleSheetPath

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting XSS attack via the styleSheetPath, which allows a malicious actor to inject javascript into the web page. This...