| Max CVSS | 7.5 | Min CVSS | 4.3 | Total Count | 2 |
| ID | CVSS | Summary | Last (major) update | Published | |
| CVE-2014-0193 | 5.0 |
WebSocket08FrameDecoder in Netty 3.6.x before 3.6.9, 3.7.x before 3.7.1, 3.8.x before 3.8.2, 3.9.x before 3.9.1, and 4.0.x before 4.0.19 allows remote attackers to cause a denial of service (memory consumption) via a TextWebSocketFrame followed by a
|
13-02-2023 - 00:36 | 06-05-2014 - 14:55 | |
| CVE-2014-0107 | 7.5 |
The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or ac
|
20-10-2021 - 11:15 | 15-04-2014 - 23:13 | |
| CVE-2014-0034 | 4.3 |
The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not properly validate SAML tokens when caching is enabled, which allows remote attackers to gain access via an invalid SAML token.
|
16-06-2021 - 12:15 | 07-07-2014 - 14:55 | |
| CVE-2014-0110 | 4.3 |
Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (/tmp disk consumption) via a large invalid SOAP message.
|
16-06-2021 - 12:15 | 08-05-2014 - 14:29 | |
| CVE-2014-0109 | 4.3 |
Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (memory consumption) via a large request with the Content-Type set to text/html to a SOAP endpoint, which triggers an error.
|
16-06-2021 - 12:15 | 08-05-2014 - 14:29 | |
| CVE-2014-0035 | 4.3 |
The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken, transmits the UsernameToken in cleartext, which allows remote attackers
|
16-06-2021 - 12:15 | 07-07-2014 - 14:55 | |
| CVE-2014-0168 | 6.8 |
Cross-site request forgery (CSRF) vulnerability in Jolokia before 1.2.1 allows remote attackers to hijack the authentication of users for requests that execute MBeans methods via a crafted web page.
|
07-10-2014 - 15:20 | 06-10-2014 - 14:55 | |
| CVE-2014-0074 | 7.5 |
Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty (1) username or (2) password.
|
07-10-2014 - 14:16 | 06-10-2014 - 14:55 |