Package · Maven

org.apache.cxf:apache-cxf

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

Medium 6.1

CVE-2019-17573 Public exploit

Reflected Cross-Site Scripting in Apache CXF

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack, which allows a malicious actor to inject javascript into the web p…

Apache CXF org.apache.cxf:cxf org.apache.cxf:apache-cxf Maven

Jan 16, 2020
High 8.1

CVE-2018-8039 Public exploit

Apache CXF TLS hostname verification does not work correctly with com.sun.net.ssl.*

It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty("java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol");'. When this system property is set, CXF uses some reflection to try to make the Ho…

Apache Software Foundation Apache CXF org.apache.cxf:apache-cxf org.apache.cxf:cxf-rt-transports-http Maven

Jul 2, 2018