Apache CXF Fediz

2 results · Clear filters · Feed

• High —
  CVE-2018-8038 Public exploit EPSS 10%

  High severity vulnerability that affects org.apache.cxf.fediz:fediz-jetty8, org.apache.cxf.fediz:fediz-jetty9, org.apache.cxf.fediz:fediz-spring, org.apache.cxf.fediz:fediz-spring2, and org.apache.cxf.fediz:fediz-spring3

  Versions of Apache CXF Fediz prior to 1.4.4 do not fully disable Document Type Declarations (DTDs) when either parsing the Identity Provider response in the application plugins, or in the Identity Provider itself when parsing certain XML-based parameters.

  Apache Software Foundation Apache CXF Fediz org.apache.cxf.fediz:fediz-spring2 org.apache.cxf.fediz:fediz-spring Maven
  Jul 5, 2018
• High 8.8
  CVE-2017-7662

  Cross-Site Request Forgery in Apache CXF Fediz

  Apache CXF Fediz ships with an OpenId Connect (OIDC) service which has a Client Registration Service, which is a simple web application that allows clients to be created, deleted, etc. A CSRF (Cross Style Request Forgery) style vulnerability has been found in…

  Apache Software Foundation Apache CXF Fediz org.apache.cxf.fediz:fediz-oidc Maven
  May 16, 2017