CVE-2024-28752

Apache CXF CVE-2024-28752 Ambiente de reprodução Aviso de vulnerabilidade: https://cxf.apache.org/security-advisories.data/CVE-2024-28752.txt Inicialização do ambiente samples/javafirstjaxwsfactorybean IDEA Inicie o serviço webservice via ServerStarter.java Construção Usando JDK8 root@kitploit: m...

asf__cxf_CVE-2016-6812_3-0-11

¡Bienvenido a Apache CXF! Apache CXF es un framework de servicios de código abierto. CXF te ayuda a construir y desarrollar servicios utilizando APIs de programación frontend, como JAX-WS y JAX-RS. Estos servicios pueden hablar una variedad de protocolos como SOAP, XML/HTTP, HTTP RESTful o CORBA ...

CVE-2022-46364-Poc

CVE-2022-46364 Exploit Apache CXF SSRF tramite MTOM XOP:Include | CVSS 9.8 CRITICO Vulnerabilità Apache CXF -s -d -t, --target - Endpoint SOAP CXF vulnerabile obbligatorio -s, --ssrf-url - URL interno da esfiltrare obbligatorio -d, --domain - Dominio di destinazione predefinito: localhost...

CVE-2022-46364---Apache-CXF-XOP-Include-LFI-PoC

Apache CXF XOP Include LFI CVE-2022-46364 Übersicht Dieses Repository enthält einen Proof-of-Concept PoC-Exploit für CVE-2022-46364 , eine Local File Inclusion LFI-Sicherheitslücke in Apache CXF. Die Sicherheitslücke entsteht durch unsachgemäße Handhabung von XOP XML-binary Optimized Packaging...

CVE-2022-46364-htb-ctf

Outil d'exploitation SOAP DevArea CVE-2022-46364 Description Cet exploit spécialisé cible l'environnement DevArea sur Hack The Box. Il exploite une vulnérabilité critique dans Apache CXF 3.2.14 CVE-2022-46364 pour effectuer une inclusion locale de fichiers LFI et une falsification de requête côté...

CVE-2026-63687

A flaw was found in Apache CXF. This vulnerability allows an attacker, who has compromised a client's secret, to bypass critical security protections in the authorization process. By injecting malicious values for parameters like codechallenge and nonce, the attacker can undermine the integrity o...

CVE-2022-46364-Proof-of-the-concept

CVE-2022-46364: Apache CXF MTOM XOP:Include SSRF zu LFI Exploit ⚠️ HAFTUNGSAUSSCHLUSS DIESES WERKZEUG IST NUR FÜR BILDUNGSZWECKE UND AUTORISIERTE SICHERHEITSTESTS GEEIGNET Dieser Proof-of-Concept-Exploit wird zu Bildungszwecken bereitgestellt, um Sicherheitsexperten zu helfen, die Schwachstelle zu...

CVE-2026-46592

CVE-2026-46592 — Iniezione dell'header operationName in camel-cxf Reindirizzamento delle operazioni SOAP Reproducer proof-of-concept eseguibili per la stessa vulnerabilità Apache Camel, uno per runtime:...

CVE-2022-46364-poc

CVE-2022-46364 — Apache CXF XOP:Include SSRF / LFI Autore: 0xmid00 Vulnerabilità: SSRF / Lettura file locale tramite XOP:Include nelle richieste MTOM Interessati: Apache CXF 3.5.5 e 3.4.10 Cos'è la Vulnerabilità? Apache CXF elabora messaggi MTOM Message Transmission Optimization Mechanism che...

CVE-2022-46364

CVE-2022-46364 — Apache CXF MTOM/XOP SSRF Lettura File Exploit proof-of-concept per CVE-2022-46364 — una vulnerabilità di server-side request forgery SSRF in Apache CXF nell'elaborazione delle richieste MTOM/XOP. Riepilogo della vulnerabilità CVE-2022-46364 riguarda le versioni di Apache CXF...

asf__cxf_CVE-2019-17573_3-2-11

Willkommen bei Apache CXF! Apache CXF ist ein Open-Source-Dienstleistungsframework. CXF hilft Ihnen, Dienste mit Frontend-Programmierschnittstellen wie JAX-WS und JAX-RS zu erstellen und zu entwickeln. Diese Dienste können eine Vielzahl von Protokollen wie SOAP, XML/HTTP, RESTful HTTP oder CORBA...

CRLF Injection

Apache CXF is vulnerable to CRLF Injection. The vulnerability is due to unsanitized clientId values from HTTP requests being directly included in OAuth2 server log messages, which allows an attacker to inject arbitrary content or forged log entries into server log files...

Improper Validation Of Specified Type Of Input

Apache CXF is vulnerable to Improper Validation of Specified Type of Input. The vulnerability is due to incomplete validation of untrusted JMS configuration, which allows an attacker who can configure JMS for Apache CXF to inject malicious configuration and potentially execute arbitrary code...

XML External Entity (XXE) Injection

Apache CXF is vulnerable to an XML External Entity XXE injection. The vulnerability is due to insufficient JAXP hardening of SAXParserFactory configurations, which allows an attacker to exploit external entity resolution to perform out-of-band OOB requests and potentially access sensitive resourc...

Authentication Bypass

org.apache.cxf, cxf-rt-rs-security-oauth2 is vulnerable to an Authentication Bypass. The vulnerability is due to a missing throw statement in the security context check, which allows an unauthenticated network attacker to access the /services/oauth2/introspect endpoint and perform token...

Improper Access Control

org.apache.cxf, cxf-rt-rs-security-oauth2 is vulnerable to an improper access control. The vulnerability is due to an inverted IP address validation check that rejects legitimate requests from the bound IP address while allowing requests from other IP addresses, which allows an attacker to bypass...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Buinsess Automation Workflow (CVE-2026-57819, CVE-2026-54225, CVE-2026-64958)

Summary WebSphere Application Server is shipped as a component of IBM Business Automation Workflow. Information about security vulnerabilities affecting IBM WebSphere Application Server Traditional have been published in a security bulletin. Vulnerability Details Refer to the security bulletins...

CVE-2026-66909

A flaw was found in Apache CXF. The Java Message Service JMS transport component improperly deserializes inbound JMS ObjectMessages without type restrictions. A remote attacker can exploit this by sending a specially crafted message to the service's JMS destination. This vulnerability could lead ...

org.apache.camel/camel-cxf: Apache Camel CXF SOAP: Remote attacker can execute unintended operations via header manipulation

A flaw was found in the Apache Camel CXF SOAP component. A remote attacker can exploit this vulnerability by manipulating the operationName header in an unauthenticated HTTP request. This improper input validation allows the attacker to force the CxfProducer to invoke unintended SOAP operations o...

Improper Input Validation

Apache Camel is vulnerable to Improper Input Validation. The vulnerability is due to unfiltered operationName and operationNamespace headers from inbound HTTP requests, which allows an attacker to control the SOAP operation invoked by the CXF producer and potentially trigger unintended or...