Skip to content
OpenAdvisories

Package · Maven

org.apache.ws.security:wss4j

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Medium 5.9
    CVE-2011-2487

    Use of a Broken or Risky Cryptographic Algorithm in Apache WSS4J

    The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack.

    Red Hat Apache JBossWS WSS4J Maven
  • High 7.5
    CVE-2015-0226

    Use of a Broken or Risky Cryptographic Algorithm in Apache WSS4J

    Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers to recover the plaintext form of a symmetric key via a series…

    wss4j org.apache.ws.security:wss4j org.apache.wss4j:wss4j-ws-security-dom Debian Maven
  • Medium —
    CVE-2015-0227

    Improper Access Control in Apache WSS4J

    Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."

    wss4j org.apache.ws.security:wss4j wss4j:wss4j Debian Maven
  • Medium —
    CVE-2014-3623

    Improper Authentication in Apache WSS4J

    Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to …

    org.apache.ws.security:wss4j org.apache.wss4j:wss4j-ws-security-dom Maven