Cross-site Scripting (XSS)

Apache CXF HTTP transport is vulnerable to cross-site scripting XSS attacks. It exists when a request URL contains unexpected matrix parameters. Apache CXF HTTP transport uses FormattedServiceListWriter to provide an HTML page which lists the names and absolute URL addresses of the available...

CVE-2016-6812

A vulnerability was found in FormattedServiceListWriter in Apache CXF HTTP transport module that could allow an attacker to inject unexpected matrix parameters into the request URL. On a successful injection these matrix parameters will find their way back to the client in the services list page...