CVE-2021-40690

The CVE-2021-40690 issue affects Apache Santuario – XML Security for Java. All versions prior to 2.2.3 and 2.1.7 are vulnerable due to the "secureValidation" property not being passed when creating a KeyInfo from a KeyInfoReference element, enabling an XPath Transform abuse to extract local .xml ...

CVE-2023-44483

CVE-2023-44483 affects Apache Santuario – XML Security for Java; all versions prior to 2.2.6, 2.3.4, and 3.0.3 are vulnerable when using the JSR 105 API. The issue can disclose a private key in log files during XML Signature generation if debug logging is enabled, impacting confidentiality. Remed...

CVE-2019-12400

Affected software: Apache Santuario XML Security for Java 2.0.x (from 2.0.3) and all 2.1.x releases before 2.1.4. Root cause: a caching mechanism using a static pool of DocumentBuilders can cache a malicious thread-context class loader implementation registered by untrusted code, leading to reuse...

CVE-2013-4517

CVE-2013-4517: Apache Santuario XML Security for Java before 1.5.6 is vulnerable to a denial of service via crafted DTDs in Transform processing. IBM advisories reference this CVE affecting IBM InfoSphere Information Server (11.7) and note remediation by upgrading to 11.7.1.0 or 11.7.1.4 (and rel...

CVE-2013-2172

CVE-2013-2172 affects Apache Santuario XML Security for Java (1.4.x < 1.4.8; 1.5.x

CVE-2014-8152

CVE-2014-8152 affects Apache Santuario XML Security for Java 2.0.x prior to 2.0.3. The vulnerability arises from improper handling in the streaming XML Signature verification, allowing a remote attacker to bypass the streaming XML signature protection mechanism and potentially modify a crafted XM...