Skip to content
OpenAdvisories

Package · Maven

org.apache.cxf:apache-cxf

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.1
    CVE-2020-13954 EPSS 41%

    Apache CXF Reflected XSS in the services listing page via the styleSheetPath

    By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack via the styleSheetPath, which allows a malicious actor to inject ja…

    Apache Software Foundation Apache CXF org.apache.cxf:cxf org.apache.cxf:apache-cxf Maven
  • Medium 6.1
    CVE-2019-17573 Public exploit

    Reflected Cross-Site Scripting in Apache CXF

    By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack, which allows a malicious actor to inject javascript into the web p…

    Apache CXF org.apache.cxf:cxf org.apache.cxf:apache-cxf Maven
  • Medium 6.5
    CVE-2019-12406

    Potential DOS attack due to unrestricted attachment count in messages

    Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. This leaves open the possibility of a denial of service type attack, where a malicious user crafts a message containing a very large number of m…

    org.apache.cxf:cxf org.apache.cxf:apache-cxf Maven