Updated 11 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

84 results · page 2 of 2

Jan 16, 2020By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses.CVE-2019-17573 · Websites & servers · Apache · reported by security@apache.orgMedium 6.1
By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack, which allows a malicious actor to inject javascript into the web page. Please note that the attack exploits a feature which is not typically not present in modern browsers, who remove dot segments before sending the request. However, Mobile applications may be vulnerable.
Product
CXF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cxf.apache.org openwall.com
Jan 16, 2020Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the sigCVE-2019-12423 · Websites & servers · Apache · reported by security@apache.orgHigh 7.5
Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the signature of tokens issued by the service. Typically, the service obtains the public key from a local keystore (JKS/PKCS12) by specifing the path of the keystore and the alias of the keystore entry. This case is not vulnerable. However it is also possible to obtain the keys from a JWK keystore file, by setting the configuration parameter "rs.security.keystore.type" to "jwk". For this case all keys are returned in this file "as is", including all private key and secret key credentials. This is an obvious security risk if the user has configured the signature keystore file with private or secret key credentials. From CXF 3.3.5 and 3.2.12, it is mandatory to specify an alias corresponding to the id of the key in the JWK file, and only this key is returned. In addition, any private key information is omitted by default. "oct" keys, which contain secret keys, are not returned at all.
Product
CXF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cxf.apache.org lists.apache.org
Nov 6, 2019Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service.CVE-2019-12419 · Websites & servers · Apache · reported by security@apache.orgCritical 9.8
Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId parameter in the request. If a malicious client was able to somehow steal an authorization code issued to another client, then they could exploit this vulnerability to obtain an access token for the other client.
Product
Apache CXF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cxf.apache.org lists.apache.org
Nov 6, 2019Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message.CVE-2019-12406 · Websites & servers · Apache · reported by security@apache.orgMedium 6.5
Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. This leaves open the possibility of a denial of service type attack, where a malicious user crafts a message containing a very large number of message attachments. From the 3.3.4 and 3.2.11 releases, a default limit of 50 message attachments is enforced. This is configurable via the message property "attachment-max-count".
Product
CXF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cxf.apache.org lists.apache.org
Jul 5, 2018Versions of Apache CXF Fediz prior to 1.4.4 do not fully disable Document Type Declarations (DTDs) when either parsing the Identity Provider response in the appCVE-2018-8038 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Versions of Apache CXF Fediz prior to 1.4.4 do not fully disable Document Type Declarations (DTDs) when either parsing the Identity Provider response in the application plugins, or in the Identity Provider itself when parsing certain XML-based parameters.
Product
Apache CXF Fediz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cxf.apache.org securitytracker.com
Jul 2, 2018It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty("java.protocol.handler.pkgs", "com.sun.net.ssl.internalCVE-2018-8039 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.1
It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty("java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol");'. When this system property is set, CXF uses some reflection to try to make the HostnameVerifier work with the old com.sun.net.ssl.HostnameVerifier interface. However, the default HostnameVerifier implementation in CXF does not implement the method in this interface, and an exception is thrown. However, in Apache CXF prior to 3.2.5 and 3.1.16 the exception is caught in the reflection code and not properly propagated. What this means is that if you are using the com.sun.net.ssl stack with CXF, an error with TLS hostname verification will not be thrown, leaving a CXF client subject to man-in-the-middle attacks.
Product
Apache CXF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cxf.apache.org securityfocus.com
Nov 30, 2017Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications.CVE-2017-12631 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF (Cross Style Request Forgery) style vulnerability has been found in the Spring 2, Spring 3 and Spring 4 plugins in versions before 1.4.3 and 1.3.3. The vulnerability can result in a security context that is set up using a malicious client's roles for the given enduser.
Product
Apache CXF Fediz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cxf.547215.n5.nabble.com securityfocus.com
Nov 14, 2017Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications.CVE-2017-12624 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.5
Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications. It is possible to craft a message attachment header that could lead to a Denial of Service (DoS) attack on a CXF web service provider. Both JAX-WS and JAX-RS services are vulnerable to this attack. From Apache CXF 3.2.1 and 3.1.14, message attachment headers that are greater than 300 characters will be rejected by default. This value is configurable via the property "attachment-max-header-size".
Product
Apache CXF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cxf.apache.org securityfocus.com
Aug 10, 2017The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorCVE-2017-3156 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks.
Product
Apache CXF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cxf.apache.org securityfocus.com
Aug 10, 2017The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides a number of Atom JAX-RS MessageBodyReaders.CVE-2016-8739 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides a number of Atom JAX-RS MessageBodyReaders. These readers use Apache Abdera Parser which expands XML entities by default which represents a major XXE risk.
Product
Apache CXF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cxf.apache.org securityfocus.com
Aug 10, 2017The HTTP transport module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 uses FormattedServiceListWriter to provide an HTML page which lists the names aCVE-2016-6812 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.1
The HTTP transport module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 uses FormattedServiceListWriter to provide an HTML page which lists the names and absolute URL addresses of the available service endpoints. The module calculates the base URL using the current HttpServletRequest. The calculated base URL is used by FormattedServiceListWriter to build the service endpoint absolute URLs. If the unexpected matrix parameters have been injected into the request URL then these matrix parameters will find their way back to the client in the services list page which represents an XSS risk to the client.
Product
Apache CXF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cxf.apache.org securityfocus.com
Aug 8, 2017The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending an empty UsernameToken as part of a SOACVE-2012-0803 · Websites & servers · Apache · reported by Red HatCritical 9.8
The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending an empty UsernameToken as part of a SOAP request.
Product
CXF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record marc.info svn.apache.org
Jun 7, 2017Application plugins in Apache CXF Fediz before 1.1.3 and 1.2.x before 1.2.1 allow remote attackers to cause a denial of service.CVE-2015-5175 · Websites & servers · Apache · reported by Red HatHigh 7.5
Application plugins in Apache CXF Fediz before 1.1.3 and 1.2.x before 1.2.1 allow remote attackers to cause a denial of service.
Product
CXF Fediz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com securityfocus.com
May 16, 2017Apache CXF Fediz ships with an OpenId Connect (OIDC) service which has a Client Registration Service, which is a simple web application that allows clients to bCVE-2017-7662 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Apache CXF Fediz ships with an OpenId Connect (OIDC) service which has a Client Registration Service, which is a simple web application that allows clients to be created, deleted, etc. A CSRF (Cross Style Request Forgery) style vulnerability has been found in this web application in Apache CXF Fediz prior to 1.4.0 and 1.3.2, meaning that a malicious web application could create new clients, or reset secrets, etc, after the admin user has logged on to the client registration service and the session is still active.
Product
Apache CXF Fediz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cxf.apache.org securitytracker.com
May 16, 2017Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications.CVE-2017-7661 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.8
Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF (Cross Style Request Forgery) style vulnerability has been found in the Spring 2, Spring 3, Jetty 8 and Jetty 9 plugins in Apache CXF Fediz prior to 1.4.0, 1.3.2 and 1.2.4.
Product
Apache CXF Fediz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cxf.apache.org securitytracker.com
Apr 18, 2017Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker couCVE-2017-5656 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.5
Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker could craft a token which would return an identifer corresponding to a cached token for another user.
Product
Apache CXF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cxf.apache.org securityfocus.com
Apr 18, 2017JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remCVE-2017-5653 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.3
JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remote attackers to spoof servers.
Product
Apache CXF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cxf.apache.org securityfocus.com
Sep 21, 2016The application plugins in Apache CXF Fediz 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience UCVE-2016-4464 · Websites & servers · Apache · reported by Red HatCritical 9.8
The application plugins in Apache CXF Fediz 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might allow remote attackers to have bypass intended restrictions and have unspecified other impact via a crafted SAML token with a trusted signature.
Product
CXF Fediz
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cxf.apache.org openwall.com
Nov 18, 2015The SAML Web SSO module in Apache CXF before 2.7.18, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote authenticated users to bypass authentication via aCVE-2015-5253 · Websites & servers · Apache · reported by Red HatMedium 4
The SAML Web SSO module in Apache CXF before 2.7.18, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote authenticated users to bypass authentication via a crafted SAML response with a valid signed assertion, related to a "wrapping attack."
Product
CXF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cxf.apache.org rhn.redhat.com
Oct 30, 2014Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properlCVE-2014-3623 · Websites & servers · Apache · reported by Red HatMedium 5
Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors.
Product
Wss4j
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rhn.redhat.com rhn.redhat.com
Oct 30, 2014The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before 3.0.1 allows remote attackers to cause a denial of service (infinite lCVE-2014-3584 · Websites & servers · Apache · reported by Red HatMedium 5
The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before 3.0.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted SAML token in the authorization header of a request to a JAX-RS service.
Product
CXF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cxf.apache.org seclists.org
Jul 7, 2014The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptCVE-2014-0035 · Websites & servers · Apache · reported by Red HatMedium 4.3
The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken, transmits the UsernameToken in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network.
Product
CXF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cxf.apache.org rhn.redhat.com
Jul 7, 2014The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not properly validate SAML tokens when caching is enabled, which allows rCVE-2014-0034 · Websites & servers · Apache · reported by Red HatMedium 4.3
The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not properly validate SAML tokens when caching is enabled, which allows remote attackers to gain access via an invalid SAML token.
Product
CXF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cxf.apache.org rhn.redhat.com
May 8, 2014Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (/tmp disk consumption) via a large invalid SOAP message.CVE-2014-0110 · Websites & servers · Apache · reported by Red HatMedium 4.3
Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (/tmp disk consumption) via a large invalid SOAP message.
Product
CXF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cxf.apache.org rhn.redhat.com
May 8, 2014Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (memory consumption) via a large request with the Content-CVE-2014-0109 · Websites & servers · Apache · reported by Red HatMedium 4.3
Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (memory consumption) via a large request with the Content-Type set to text/html to a SOAP endpoint, which triggers an error.
Product
CXF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record rhn.redhat.com rhn.redhat.com
Aug 19, 2013The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service (CPUCVE-2013-2160 · Websites & servers · Apache · reported by Red HatMedium 5
The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via crafted XML with a large number of (1) elements, (2) attributes, (3) nested constructs, and possibly other vectors.
Product
CXF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jira.codehaus.org jira.codehaus.org
Aug 19, 2013Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WSCVE-2012-5575 · Websites & servers · Apache · reported by Red HatMedium 6.4
Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force CXF to use weaker cryptographic algorithms than intended and makes it easier to decrypt communications, aka "XML Encryption backwards compatibility attack."
Product
CXF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cxf.apache.org rhn.redhat.com
Mar 12, 2013Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bCVE-2013-0239 · Websites & servers · Apache · reported by Red HatMedium 5
Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element.
Product
CXF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cxf.apache.org osvdb.org
Mar 12, 2013The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security procesCVE-2012-5633 · Websites & servers · Apache · reported by Red HatMedium 5.8
The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request.
Product
CXF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cxf.apache.org osvdb.org
Jan 4, 2013Apache CXF 2.4.5 through 2.4.7, 2.5.1 through 2.5.3, and 2.6.x before 2.6.1, does not properly enforce child policies of a WS-SecurityPolicy 1.1 SupportingTokenCVE-2012-2378 · Websites & servers · Apache · reported by Red HatMedium 4.3
Apache CXF 2.4.5 through 2.4.7, 2.5.1 through 2.5.3, and 2.6.x before 2.6.1, does not properly enforce child policies of a WS-SecurityPolicy 1.1 SupportingToken policy on the client side, which allows remote attackers to bypass the (1) AlgorithmSuite, (2) SignedParts, (3) SignedElements, (4) EncryptedParts, and (5) EncryptedElements policies.
Product
CXF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cxf.apache.org rhn.redhat.com
Jan 2, 2013Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does nCVE-2012-2379 · Websites & servers · Apache · reported by Red HatHigh 10
Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure that an XML element is signed or encrypted, which has unspecified impact and attack vectors.
Product
CXF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cxf.apache.org rhn.redhat.com
Nov 4, 2012The wsdl_first_https sample code in distribution/src/main/release/samples/wsdl_first_https/src/main/ in Apache CXF before 2.7.0 does not verify that the server CVE-2012-5786 · Websites & servers · Apache · reported by MITREMedium 5.8
The wsdl_first_https sample code in distribution/src/main/release/samples/wsdl_first_https/src/main/ in Apache CXF before 2.7.0 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. NOTE: The vendor states that the sample had specifically used a flag to bypass the DN check
Product
CXF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cs.utexas.edu exchange.xforce.ibmcloud.com
Sep 24, 2012Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-service operations by sending a header witCVE-2012-3451 · Websites & servers · Apache · reported by Red HatMedium 4.3
Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-service operations by sending a header with a SOAP Action String that is inconsistent with the message body.
Product
CXF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cxf.apache.org rhn.redhat.com
Aug 19, 2010Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in Apache ServiceMix, Apache Camel, Apache Chemistry, Apache jUDDI, Apache CVE-2010-2076 · Websites & servers · Apache · reported by Red HatCritical 9.8
Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in Apache ServiceMix, Apache Camel, Apache Chemistry, Apache jUDDI, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a crafted DTD, as demonstrated by an entity declaration in a request to samples/wsdl_first_pure_xml, a similar issue to CVE-2010-1632.
Product
CXF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record geronimo.apache.org geronimo.apache.org

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.