Important: Red Hat Security Advisory: Fuse ESB Enterprise 7.1.0 update

Fuse ESB Enterprise 7.1.0 Patch 3, which fixes three security issues and various bugs, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which give...

apache-cxf: Bypass of security constraints on WS endpoints when using WSS4JInInterceptor

The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request...

RHEL 5 / 6 : apache-cxf (RHSA-2013:0644)

An updated apache-cxf package for JBoss Enterprise Application Platform 6.0.1 which fixes two security issues is now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CV...

Important: Red Hat Security Advisory: apache-cxf security update

An updated apache-cxf package for JBoss Enterprise Application Platform 6.0.1 which fixes two security issues is now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CV...

apache-cxf: Bypass of security constraints on WS endpoints when using WSS4JInInterceptor

The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request...

apache-cxf: UsernameTokenPolicyValidator and UsernameTokenInterceptor allow empty passwords to authenticate

Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element...

Important: Red Hat Security Advisory: apache-cxf security update

An update for the Apache CXF component of JBoss Enterprise Application Platform 6.0.1 which fixes two security issues is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring Syste...

CVE-2012-5633

The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request...

CVE-2012-5633

The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request...

Cross site request forgery (csrf)

The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request...

CVE-2013-0239

CVE-2013-0239 affects Apache CXF: versions before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3. When plaintext UsernameToken WS-SecurityPolicy is enabled, a security header containing a UsernameToken element with no password can bypass authentication. This is an authentication bypass vulnera...

CVE-2012-5633

The CVE-2012-5633 issue affects Apache CXF’s URIMappingInterceptor when paired with WSS4JInInterceptor. Versions affected are CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2. The vulnerability bypasses WS-Security processing, enabling remote attackers to bypass security and access SO...

CVE-2012-5633

The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request...

CVE-2013-0239

Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element...

PT-2013-1817 · Apache · Apache Cxf

Name of the Vulnerable Software and Affected Versions: Apache CXF versions 2.5.0 through 2.5.7 Apache CXF versions 2.6.0 through 2.6.4 Apache CXF versions 2.7.0 through 2.7.1 Description: The issue allows remote attackers to obtain access to SOAP services via an HTTP GET request, bypassing...

PT-2013-2181 · Apache · Apache Cxf

Name of the Vulnerable Software and Affected Versions: Apache CXF versions 2.5.0 through 2.5.9 Apache CXF versions 2.6.0 through 2.6.6 Apache CXF versions 2.7.0 through 2.7.3 Description: The issue allows remote attackers to bypass authentication when the plaintext UsernameToken WS-SecurityPolicy...

OpenJDK: com.sun.xml.internal.* not restricted packages (JAX-WS, 7201068)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 through Update 11 and 6 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality via vectors related to JAX-WS. NOTE: the previous information is from the February 2013 CPU...

OpenJDK: com.sun.xml.internal.* not restricted packages (JAX-WS, 7201068)

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 through Update 11 and 6 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality via vectors related to JAX-WS. NOTE: the previous information is from the February 2013 CPU...

Sun Java JRE Multiple Vulnerabilities (254569 / 254611 / 254608 ..) (Unix)

The version of Sun Java Runtime Environment JRE installed on the remote host is earlier than 6 Update 13 / 5.0 Update 18 / 1.4.220 / 1.3.125. Such versions are potentially affected by the following security issues : - A denial of service vulnerability affects the JRE LDAP implementation. 254569. ...

Oracle Java SE Multiple Vulnerabilities (February 2013 CPU) (Unix)

The version of Oracle formerly Sun Java SE or Java for Business installed on the remote host is earlier than 7 Update 13 or 6 Update 39, or is earlier than or equal to 5 Update 38 or 1.4.2 Update 40. It is, therefore, potentially affected by security issues in the following components : - 2D - AW...