GCVE - cpe:2.3:a:apache:axis:1.1:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:axis:1.1:*:*:*:*:*:*:*

part: a version: 1.1 update: *

Vendor	Apache (`b0303047-b7dd-5cf8-abcc-71b7d9d80b95`)
Product	Axis (`0df394f9-8430-5adc-96b4-67ccbea8a234`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:apache/axis`	purl2cpe	2026-06-01 10:14:28.156247
`pkg:deb/debian/axis`	purl2cpe	2026-06-01 10:14:28.156248
`pkg:deb/ubuntu/axis`	purl2cpe	2026-06-01 10:14:28.156250
`pkg:github/apache/axis-site`	purl2cpe	2026-06-01 10:14:28.156251
`pkg:maven/org.apache.axis/axis`	purl2cpe	2026-06-01 10:14:28.156252

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2014-3596`	vulnerable	2026-06-08 05:05:33.665922	Details available The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5784. Published: 2014-08-27T00:00:00.000Z Updated: 2024-08-06T10:50:17.677Z Open on db.gcve.eu Reference links http://www.openwall.com/lists/oss-security/2014/08/20/2 https://issues.apache.org/jira/browse/AXIS-2905 https://exchange.xforce.ibmcloud.com/vulnerabilities/95377 http://www.securitytracker.com/id/1030745 http://secunia.com/advisories/61222	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-5784`	vulnerable	2026-06-08 05:02:58.229534	Details available Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. Published: 2012-11-04T22:00:00.000Z Updated: 2024-08-06T21:14:16.399Z Open on db.gcve.eu Reference links http://rhn.redhat.com/errata/RHSA-2013-0269.html http://rhn.redhat.com/errata/RHSA-2014-0037.html http://secunia.com/advisories/51219 http://rhn.redhat.com/errata/RHSA-2013-0683.html http://www.securityfocus.com/bid/56408	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.