Поиск уязвимостей
Количество 16
Количество 16
ALT-PU-2016-3286
ALT-PU-2016-3286: package `wss4j` update to version 1.6.18-alt1_3jpp8
CVE-2014-3623
Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors.
CVE-2014-3623
Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors.
GHSA-99v3-9x35-c5vf
Improper Authentication in Apache WSS4J
BDU:2022-06637
Уязвимость программного средства Apache WSS4J, связанная с недостатками процедуры аутентификации, позволяющая нарушителю обойти процесс аутентификации
CVE-2015-0227
Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."
CVE-2015-0227
Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."
CVE-2015-0227
Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."
CVE-2015-0227
Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attacker ...
CVE-2015-0226
Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers to recover the plaintext form of a symmetric key via a series of crafted messages. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-2487.
CVE-2015-0226
Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers to recover the plaintext form of a symmetric key via a series of crafted messages. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-2487.
CVE-2015-0226
Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers to recover the plaintext form of a symmetric key via a series of crafted messages. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-2487.
CVE-2015-0226
Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks inf ...
ALT-PU-2017-3639
ALT-PU-2017-3639: package `cxf` update to version 3.1.6-alt1_5jpp8
GHSA-vjwc-5hfh-2vv5
Use of a Broken or Risky Cryptographic Algorithm in Apache WSS4J
GHSA-6r5v-hp32-fjqw
Improper Access Control in Apache WSS4J
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
| ALT-PU-2016-3286 ALT-PU-2016-3286: package `wss4j` update to version 1.6.18-alt1_3jpp8 | CVSS3: 7.5 | почти 11 лет назад | |
 | CVE-2014-3623 Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors. | CVSS2: 4.3 | 9% Низкий | около 12 лет назад |
 | CVE-2014-3623 Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors. | CVSS2: 5 | 9% Низкий | около 12 лет назад |
| GHSA-99v3-9x35-c5vf Improper Authentication in Apache WSS4J | 9% Низкий | больше 4 лет назад | |
 | BDU:2022-06637 Уязвимость программного средства Apache WSS4J, связанная с недостатками процедуры аутентификации, позволяющая нарушителю обойти процесс аутентификации | CVSS3: 5.3 | 9% Низкий | около 12 лет назад |
 | CVE-2015-0227 Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks." | CVSS2: 5 | 8% Низкий | больше 11 лет назад |
| CVE-2015-0227 Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks." | CVSS2: 4 | 8% Низкий | почти 12 лет назад |
| CVE-2015-0227 Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks." | CVSS2: 5 | 8% Низкий | больше 11 лет назад |
| CVE-2015-0227 Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attacker ... | CVSS2: 5 | 8% Низкий | больше 11 лет назад |
| CVE-2015-0226 Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers to recover the plaintext form of a symmetric key via a series of crafted messages. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-2487. | CVSS3: 7.5 | 6% Низкий | около 9 лет назад |
| CVE-2015-0226 Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers to recover the plaintext form of a symmetric key via a series of crafted messages. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-2487. | CVSS2: 7.8 | 6% Низкий | почти 12 лет назад |
| CVE-2015-0226 Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers to recover the plaintext form of a symmetric key via a series of crafted messages. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-2487. | CVSS3: 7.5 | 6% Низкий | около 9 лет назад |
| CVE-2015-0226 Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks inf ... | CVSS3: 7.5 | 6% Низкий | около 9 лет назад |
| ALT-PU-2017-3639 ALT-PU-2017-3639: package `cxf` update to version 3.1.6-alt1_5jpp8 | CVSS3: 5.3 | около 9 лет назад | |
| GHSA-vjwc-5hfh-2vv5 Use of a Broken or Risky Cryptographic Algorithm in Apache WSS4J | CVSS3: 7.5 | 6% Низкий | больше 4 лет назад |
| GHSA-6r5v-hp32-fjqw Improper Access Control in Apache WSS4J | 8% Низкий | больше 4 лет назад |
Уязвимостей на страницу