Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via XPath conversion in PolicyUtils and matching in SignedElementsAssertionState and related element assertion states in the StAX WS-SecurityPolicy validator. A remote SOAP peer can send ...

cv.igrp:igrp-core (>=2.0.0.230625-alpha, <=2.0.0.240307-rc2), cv.igrp:igrp-core-war (>=2.0.0.230625-alpha, <=2.0.0.230801-beta) +91 more potentially affected by CVE-2026-87830 via org.apache.wss4j:wss4j-ws-security-policy-stax (>=3.0.0, <=3.0.5)

org.apache.wss4j:wss4j-ws-security-policy-stax MAVEN version =3.0.0, =2.0.0.230625-alpha, =2.0.0.230625-alpha, =4.0.2, =2.4.0, =4.1.0-tomee-m1, =4.1.0-tomee-m1, =4.1.0-tomee-m1, =4.1.0-tomee-m1, =2.0.0.alpha1, =2.7.0.cr1, =3.8.0, =2.0.0.alpha1, =2.2.4, =2...

cloud.altemista.fwk.framework:cloud-altemistafwk-documentation (3.1.0.release), cloud.altemista.fwk.soap:cloud-altemistafwk-core-soap-wss (>=3.0.0.release, <=3.1.0.release) +280 more potentially affected by CVE-2026-87830 via org.apache.wss4j:wss4j-ws-security-policy-stax (>=2.0.0, <=2.4.3)

org.apache.wss4j:wss4j-ws-security-policy-stax MAVEN version =2.0.0, =3.0.0.release, =3.0.0.release, =3.0.0.release, =3.0.0.release, =1.0.0, =1.2.0, =1.4.0, =4.2.0.1, =1.7.2.230613, =1.7.2.230622, =1.7.3.230802 and more Source cves: CVE-2026-87830 Source advisory: MEND:CVE-2026-87830...

com.codinglair.taf:taf-api-soap (>=1.0.0, <=1.3.0), io.bitbucket.dsmoons:odk-test-framework (>=2.5.1, <=2.5.2) +85 more potentially affected by CVE-2026-87830 via org.apache.wss4j:wss4j-ws-security-policy-stax (>=4.0.0, <=4.0.1)

org.apache.wss4j:wss4j-ws-security-policy-stax MAVEN version =4.0.0, =1.0.0, =2.5.1, =4.2.0-tomee-m0-ce15546, =4.2.0-tomee-m0-ce15546, =4.2.0-tomee-m0-ce15546, =4.2.0-tomee-m0-ce15546, =1.3, =1.3, =1.3, =1.5.0 and more Source cves: CVE-2026-87830 So...

EUVD-2009-0900

Malware in sbrugna...

EUVD-2010-3186

Malware in sbrugna...

GHSA-P5C5-6564-VVR8 Improper Authentication in Apache CXF

Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element...

apache-cxf: XML encryption backwards compatibility attacks

Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force CXF to use weaker cryptographic...

apache-cxf: XML encryption backwards compatibility attacks

Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force CXF to use weaker cryptographic...

apache-cxf: UsernameTokenPolicyValidator and UsernameTokenInterceptor allow empty passwords to authenticate

Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element...

apache-cxf: Apache CXF does not verify that elements were signed / encrypted by a particular Supporting Token

Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure that an XML element is signed or encrypted, which has unspecified impact and attack vectors...

apache-cxf: Apache CXF does not verify that elements were signed / encrypted by a particular Supporting Token

Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure that an XML element is signed or encrypted, which has unspecified impact and attack vectors...

apache-cxf: Apache CXF does not verify that elements were signed / encrypted by a particular Supporting Token

Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure that an XML element is signed or encrypted, which has unspecified impact and attack vectors...

apache-cxf: Apache CXF does not verify that elements were signed / encrypted by a particular Supporting Token

Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure that an XML element is signed or encrypted, which has unspecified impact and attack vectors...

PT-2013-1563 · Apache · Apache Cxf

Name of the Vulnerable Software and Affected Versions: Apache CXF versions 2.4.x through 2.4.7 Apache CXF versions 2.5.x through 2.5.3 Apache CXF versions 2.6.x through 2.6.0 Description: The issue arises when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, and the...

apache-cxf: Apache CXF does not verify that elements were signed / encrypted by a particular Supporting Token

Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure that an XML element is signed or encrypted, which has unspecified impact and attack vectors...

apache-cxf: Certain child policies of WS-SecurityPolicy 1.1 SupportingToken policy not applied on the client side

Apache CXF 2.4.5 through 2.4.7, 2.5.1 through 2.5.3, and 2.6.x before 2.6.1, does not properly enforce child policies of a WS-SecurityPolicy 1.1 SupportingToken policy on the client side, which allows remote attackers to bypass the 1 AlgorithmSuite, 2 SignedParts, 3 SignedElements, 4...

apache-cxf: Apache CXF does not verify that elements were signed / encrypted by a particular Supporting Token

Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure that an XML element is signed or encrypted, which has unspecified impact and attack vectors...

apache-cxf: Apache CXF does not verify that elements were signed / encrypted by a particular Supporting Token

Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure that an XML element is signed or encrypted, which has unspecified impact and attack vectors...

apache-cxf: Apache CXF does not verify that elements were signed / encrypted by a particular Supporting Token

Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure that an XML element is signed or encrypted, which has unspecified impact and attack vectors...