https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 19:36:52 +0000 https://cve.radiocsirt.org/vuln/bdu:2020-04512 bdu:2020-04512 https://cve.radiocsirt.org/vuln/bdu:2020-04512 https://cve.radiocsirt.org/vuln/cnvd-2020-04127 cnvd-2020-04127 https://cve.radiocsirt.org/vuln/cnvd-2020-04127 https://cve.radiocsirt.org/vuln/euvd-2026-58484 EUVD-2026-58484 https://cve.radiocsirt.org/vuln/euvd-2026-58484 https://cve.radiocsirt.org/vuln/fkie_cve-2019-17573 <p>By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack, which allows a malicious actor to inject javascript into the web page. Please note that the attack exploits a feature which is not typically not present in modern browsers, who remove dot segments before sending the request. However, Mobile applications may be vulnerable.</p> <p>By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack, which allows a malicious actor to inject javascript into the web page. Please note that the attack exploits a feature which is not typically not present in modern browsers, who remove dot segments before sending the request. However, Mobile applications may be vulnerable.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2019-17573 https://cve.radiocsirt.org/vuln/ghsa-f93p-f762-vr53 <p><strong>Affected:</strong> Maven: org.apache.cxf:apache-cxf, Maven: org.apache.cxf:cxf</p> <p>By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack, which allows a malicious actor to inject javascript into the web page. Please note that the attack exploits a feature which is not typically not present in modern browsers, who remove dot segments before sending the request. However, Mobile applications may be vulnerable.</p> <p><strong>Affected:</strong> Maven: org.apache.cxf:apache-cxf, Maven: org.apache.cxf:cxf</p> <p>By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack, which allows a malicious actor to inject javascript into the web page. Please note that the attack exploits a feature which is not typically not present in modern browsers, who remove dot segments before sending the request. However, Mobile applications may be vulnerable.</p> https://cve.radiocsirt.org/vuln/ghsa-f93p-f762-vr53 https://cve.radiocsirt.org/vuln/gsd-2019-17573 gsd-2019-17573 https://cve.radiocsirt.org/vuln/gsd-2019-17573 https://cve.radiocsirt.org/vuln/rhsa-2020:2058 <p>jackson-mapper-asl: XML external entity similar to CVE-2016-3720 cxf: OpenId Connect token service does not properly validate the clientId cxf: reflected XSS in the services listing page Wildfly: EJBContext principal is not popped back after invoking another EJB using a different Security Domain SmallRye: SecuritySupport class is incorrectly public and contains a static method to access the current threads context class loader Soteria: security identity corruption across concurrent threads undertow: AJP File Read/Inclusion Vulnerability undertow: servletPath is normalized incorrectly leading to dangerous application mapping which could result in security bypass cryptacular: excessive memory allocation during a decode operation undertow: Memory exhaustion issue in HttpReadListener via &#34;Expect: 100-continue&#34; header undertow: invalid HTTP request with large chunk size</p> <p>jackson-mapper-asl: XML external entity similar to CVE-2016-3720 cxf: OpenId Connect token service does not properly validate the clientId cxf: reflected XSS in the services listing page Wildfly: EJBContext principal is not popped back after invoking another EJB using a different Security Domain SmallRye: SecuritySupport class is incorrectly public and contains a static method to access the current threads context class loader Soteria: security identity corruption across concurrent threads undertow: AJP File Read/Inclusion Vulnerability undertow: servletPath is normalized incorrectly leading to dangerous application mapping which could result in security bypass cryptacular: excessive memory allocation during a decode operation undertow: Memory exhaustion issue in HttpReadListener via &#34;Expect: 100-continue&#34; header undertow: invalid HTTP request with large chunk size</p> https://cve.radiocsirt.org/vuln/rhsa-2020:2058 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2123 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat JBoss Enterprise Application Platform ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsvorkehrungen zu umgehen, einen Cross-Site-Angriff durchzuführen, einen Denial of Service Zustand herbeizuführen, Informationen offenzulegen oder Dateien zu manipulieren.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat JBoss Enterprise Application Platform ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsvorkehrungen zu umgehen, einen Cross-Site-Angriff durchzuführen, einen Denial of Service Zustand herbeizuführen, Informationen offenzulegen oder Dateien zu manipulieren.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2123