Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 26

Export CSV
CVE-2012-5633

apache-cxf: Bypass of security constraints on WS endpoints when using WSS4JInInterceptor

The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request.

CVSS 2.0 · 5.8 Medium EPSS 8.2% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Fuse Esb Enterprise Jboss Enterprise Application Platform and 4 more
CVE-2013-0239

apache-cxf: UsernameTokenPolicyValidator and UsernameTokenInterceptor allow empty passwords to authenticate

Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element.

CVSS 2.0 · 5.0 Medium EPSS 4.7% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Fuse Esb Enterprise Jboss Enterprise Application Platform and 1 more
CVE-2013-0269

rubygem-json: Denial of Service and SQL Injection

The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."

CVSS 2.0 · 7.5 High EPSS 13.9% KEV · Not listed
Vendors
Redhat Rhel Sam Rubygems
Products
Fuse Esb Enterprise Jboss Enterprise Soa Platform Jboss Fuse and 3 more
CVE-2013-1768

openjpa: Remote arbitrary code execution by creating a serialized object and leveraging improperly secured server programs

The BrokerFactory functionality in Apache OpenJPA 1.x before 1.2.3 and 2.x before 2.2.2 creates local executable JSP files containing logging trace data produced during deserialization of certain crafted OpenJPA objects, which makes it easier for remote attackers to execute arbitrary code by creating a serialized object and leveraging improperly secured server programs.

CVSS 2.0 · 7.5 High EPSS 9.5% KEV · Not listed
Vendors
Apache Redhat
Products
Openjpa Fuse Esb Enterprise Fuse Management Console and 2 more
CVE-2013-2160

apache-cxf: Multiple denial of service flaws in the StAX parser

The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via crafted XML with a large number of (1) elements, (2) attributes, (3) nested constructs, and possibly other vectors.

CVSS 2.0 · 5.0 Medium EPSS 32.3% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Fuse Esb Enterprise Jboss Enterprise Portal Platform and 1 more