Vulmon Recent Vulnerabilities Product List Research Posts Trends Blog About Contact

apache cxf vulnerabilities and exploits

(subscribe to this query)
5
CVSSv2

CVE-2013-0239

Apache CXF prior to 2.5.9, 2.6.x prior to 2.6.6, and 2.7.x prior to 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote malicious users to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a...
Apache CxfApache Cxf 2.4.0Apache Cxf 2.4.1Apache Cxf 2.4.2Apache Cxf 2.4.3Apache Cxf 2.4.4Apache Cxf 2.4.5Apache Cxf 2.4.6Apache Cxf 2.4.7Apache Cxf 2.5.0Apache Cxf 2.5.1Apache Cxf 2.5.2
5.8
CVSSv2

CVE-2012-5633

The URIMappingInterceptor in Apache CXF prior to 2.5.8, 2.6.x prior to 2.6.5, and 2.7.x prior to 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote malicious users to obtain access to SOAP services via an HTTP GET request.
Apache CxfApache Cxf 2.5.0Apache Cxf 2.5.1Apache Cxf 2.5.2Apache Cxf 2.5.3Apache Cxf 2.5.4Apache Cxf 2.5.5Apache Cxf 2.5.6Apache Cxf 2.6.0Apache Cxf 2.6.1Apache Cxf 2.6.2Apache Cxf 2.6.3
10
CVSSv2

CVE-2012-2379

Apache CXF 2.4.x prior to 2.4.8, 2.5.x prior to 2.5.4, and 2.6.x prior to 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure that an XML element is signed or encrypted, which has unspecified impact and attack vectors.
Apache Cxf 2.4.0Apache Cxf 2.4.1Apache Cxf 2.4.2Apache Cxf 2.4.3Apache Cxf 2.4.4Apache Cxf 2.4.5Apache Cxf 2.4.6Apache Cxf 2.4.7Apache Cxf 2.5.0Apache Cxf 2.5.1Apache Cxf 2.5.2Apache Cxf 2.5.3
7.5
CVSSv3

CVE-2016-8739

The JAX-RS module in Apache CXF before 3.0.12 and 3.1.x before 3.1.9 provides a number of Atom JAX-RS MessageBodyReaders. These readers use Apache Abdera Parser which expands XML entities by default which represents a major XXE risk.
Apache CxfApache Cxf 3.1.0Apache Cxf 3.1.1Apache Cxf 3.1.2Apache Cxf 3.1.3Apache Cxf 3.1.4Apache Cxf 3.1.5Apache Cxf 3.1.6Apache Cxf 3.1.7Apache Cxf 3.1.8
6.1
CVSSv3

CVE-2016-6812

The HTTP transport module in Apache CXF before 3.0.12 and 3.1.x before 3.1.9 uses FormattedServiceListWriter to provide an HTML page which lists the names and absolute URL addresses of the available service endpoints. The module calculates the base URL using the current HttpServl...
Apache CxfApache Cxf 3.1.0Apache Cxf 3.1.1Apache Cxf 3.1.2Apache Cxf 3.1.3Apache Cxf 3.1.4Apache Cxf 3.1.5Apache Cxf 3.1.6Apache Cxf 3.1.7Apache Cxf 3.1.8
4.3
CVSSv2

CVE-2012-2378

Apache CXF 2.4.5 up to and including 2.4.7, 2.5.1 up to and including 2.5.3, and 2.6.x prior to 2.6.1, does not properly enforce child policies of a WS-SecurityPolicy 1.1 SupportingToken policy on the client side, which allows remote malicious users to bypass the (1) AlgorithmSui...
Apache Cxf 2.4.5Apache Cxf 2.4.6Apache Cxf 2.4.7Apache Cxf 2.5.1Apache Cxf 2.5.2Apache Cxf 2.5.3Apache Cxf 2.6.0
6.4
CVSSv2

CVE-2012-5575

Apache CXF 2.5.x prior to 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote malicious users to force CXF to use w...
Apache Cxf 2.5.0Apache Cxf 2.5.1Apache Cxf 2.5.2Apache Cxf 2.5.3Apache Cxf 2.5.4Apache Cxf 2.5.5Apache Cxf 2.5.6Apache Cxf 2.5.7Apache Cxf 2.5.8Apache Cxf 2.5.9Apache Cxf 2.6.0Apache Cxf 2.6.1
8.8
CVSSv3

CVE-2017-12631

Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF (Cross Style Request Forgery) style vulnerability has been found in the Spring 2, Spring 3 and Spring 4 plugins in versions prior to 1.4.3 and 1.3.3. The vulnerabil...
Apache Cxf FedizApache Cxf Fediz 1.4.0Apache Cxf Fediz 1.4.1Apache Cxf Fediz 1.4.2
9.8
CVSSv3

CVE-2016-4464

The application plugins in Apache CXF Fediz 1.2.x prior to 1.2.3 and 1.3.x prior to 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might allow remote malicious users to have bypass intended restrictions and have unspecified other impact...
Apache Cxf Fediz 1.2.0Apache Cxf Fediz 1.2.1Apache Cxf Fediz 1.2.2Apache Cxf Fediz 1.3.0
8.8
CVSSv3

CVE-2017-7661

Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF (Cross Style Request Forgery) style vulnerability has been found in the Spring 2, Spring 3, Jetty 8 and Jetty 9 plugins in Apache CXF Fediz before 1.4.0, 1.3.2 and ...
Apache Cxf FedizApache Cxf Fediz 1.2.4Apache Cxf Fediz 1.3.2
Preferred Score:
CVSSv3
CVSSv2
CVSSv3
CVSSv4
EPSS
VMScore
Recommendations:
CVE-2024-55591CVE-2024-13184unauthorizedinformation disclosureCVE-2024-13385CVE-2024-43468denial of serviceCVE-2024-57370CVE-2025-21606
Home
/
Search Results
Vulmon Logo Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook