Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 51
Reset filtersApache cxf-core: No restriction on attachment headers per message
Apache CXF: WS JSON request filter trusts metadata from an unvalidated first signature entry
Apache CXF JNDI Injection vulnerability in DispatchMDBMessageListenerImpl
Apache CXF has Improper Restriction of XML External Entity Reference
Apache CXF has Authentication Bypass in OAuth2 TokenIntrospectionService
Apache CXF OAuth2 Log Injection via Unsanitized Client Identifier
Apache CXF OAuth2 has Inverted IP Binding Check that Defeats Security Control
Apache CXF OAuth2 TOCTOU Race Condition in Refresh Token Processing
Apache CXF OAuth2 Missing JWT Audience and Issuer Validation in Access Token Validator
Apache CXF OAuth2 HTTP Response Splitting via WWW-Authenticate Realm Injection
Apache CXF's WS-Transfer module has an insecure XML parser configuration
Apache CXF: Untrusted JMS configuration can lead to RCE
Apache CXF: Untrusted JMS configuration can lead to RCE
Apache CXF is vulnerable to DoS attacks as entire files are read into memory and logged
Apache CXF: Denial of Service vulnerability with temporary files
Apache CXF: SSRF vulnerability via WADL stylesheet parameter
Apache CXF allows unrestricted memory consumption in CXF HTTP clients
Apache CXF Denial of Service vulnerability in JOSE
SSRF vulnerability using the Aegis DataBinding in Apache CXF
Apache CXF Server-Side Request Forgery vulnerability
Apache CXF vulnerable to Exposure of Sensitive Information
Improper Input Validation in Apache CXF
Improper Authentication in Apache CXF
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.