CVE-2018-8038
Published Jul 5, 2018Versions of Apache CXF Fediz prior to 1.4.4 do not fully disable Document Type Declarations (DTDs) when either parsing the Identity Provider response in the application plugins, o…
Vendor/product archive
apache / cxf_fediz CVEs
Beta · best-effort6 CVEs tagged to apache / cxf_fediz — 1 Critical, 5 High, 0 Medium, 0 Low, 0 Unrated.
CVE-2017-12631
Published Nov 30, 2017Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF (Cross Style Request Forgery) style vulnerability has been foun…
CVE-2015-5175
Published Jun 7, 2017Application plugins in Apache CXF Fediz before 1.1.3 and 1.2.x before 1.2.1 allow remote attackers to cause a denial of service.
CVE-2017-7662
Published May 16, 2017Apache CXF Fediz ships with an OpenId Connect (OIDC) service which has a Client Registration Service, which is a simple web application that allows clients to be created, deleted,…
CVE-2017-7661
Published May 16, 2017Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF (Cross Style Request Forgery) style vulnerability has been foun…
CVE-2016-4464
Published Sep 21, 2016The application plugins in Apache CXF Fediz 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience URIs, which might al…
Showing 1-6 of 6 CVEsPage 1 of 1