Skip to content
OpenAdvisories

Package · Debian

wss4j

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 4.8
    CVE-2026-92899

    Apache WSS4J: UsernameToken replay protection bypassed by re-encoding the Nonce

    Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but authentication decodes that text and uses the bytes.The same bytes can be written as base64 in several ways. A…

    Apache Software Foundation Apache WSS4J wss4j wss4j Debian Ubuntu
  • Medium —
    CVE-2015-0227

    Improper Access Control in Apache WSS4J

    Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."

    wss4j org.apache.ws.security:wss4j wss4j:wss4j Debian Maven