Поиск уязвимостей
Количество 6
Количество 6
CVE-2014-3623
Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors.
CVE-2014-3623
Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors.
GHSA-99v3-9x35-c5vf
Improper Authentication in Apache WSS4J
BDU:2022-06637
Уязвимость программного средства Apache WSS4J, связанная с недостатками процедуры аутентификации, позволяющая нарушителю обойти процесс аутентификации
ALT-PU-2017-3639
ALT-PU-2017-3639: package `cxf` update to version 3.1.6-alt1_5jpp8
ALT-PU-2016-3286
ALT-PU-2016-3286: package `wss4j` update to version 1.6.18-alt1_3jpp8
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2014-3623 Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors. | CVSS2: 4.3 | 9% Низкий | около 12 лет назад |
 | CVE-2014-3623 Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors. | CVSS2: 5 | 9% Низкий | около 12 лет назад |
| GHSA-99v3-9x35-c5vf Improper Authentication in Apache WSS4J | 9% Низкий | больше 4 лет назад | |
 | BDU:2022-06637 Уязвимость программного средства Apache WSS4J, связанная с недостатками процедуры аутентификации, позволяющая нарушителю обойти процесс аутентификации | CVSS3: 5.3 | 9% Низкий | около 12 лет назад |
| ALT-PU-2017-3639 ALT-PU-2017-3639: package `cxf` update to version 3.1.6-alt1_5jpp8 | CVSS3: 5.3 | около 9 лет назад | |
| ALT-PU-2016-3286 ALT-PU-2016-3286: package `wss4j` update to version 1.6.18-alt1_3jpp8 | CVSS3: 7.5 | почти 11 лет назад |
Уязвимостей на страницу