Most recent entries from all

bdu:2020-00858

cnvd-2019-41853

EUVD-2026-55005

fkie_cve-2019-12419

Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId parameter in the request. If a malicious client was able to somehow steal an authorization code issued to another client, then they could exploit this vulnerability to obtain an access token for the other client.

GHSA-cw6w-q88j-6mqf — Potential session hijack in Apache CXF

Affected: Maven: org.apache.cxf:cxf

gsd-2019-12419

RHSA-2020:2067 — Red Hat Security Advisory: Red Hat build of Thorntail 2.5.1 security and bug fix update

thrift: Endless loop when feed with specific input data thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol keycloak: missing signatures validation on CRL used to verify client certificates HTTP/2: large amount of data requests leads to denial of service HTTP/2: flood using PING frames results in unbounded memory growth HTTP/2: flood using HEADERS frames results in unbounded memory growth HTTP/2: flood using SETTINGS frames results in unbounded memory growth apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default keycloak: CSRF check missing in My Resources functionality in the Account Console keycloak: SAML broker does not check existence of signature on document allowing any user impersonation hibernate-validator: safeHTML validator allows XSS xml-security: Apache Santuario potentially loads XML parsing code from an untrusted source cxf: does not restrict the number of message attachments cxf: OpenId Connect token service does not properly validate the clientId jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariConfig keycloak: adapter endpoints are exposed via arbitrary URLs keycloak: cross-realm user access auth bypass wildfly-core: Incorrect privileges for 'Monitor', 'Auditor' and 'Deployer' user by default wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is in use undertow: possible Denial Of Service (DOS) in Undertow HTTP server listen…

WID-SEC-W-2022-1825 — Apache CXF: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apache CXF ausnutzen, um einen Denial of Service Angriff durchzuführen oder um Sicherheitsvorkehrungen zu umgehen.