GCVE - cpe:2.3:a:apache:cxf:2.6.9:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:cxf:2.6.9:*:*:*:*:*:*:*

part: a version: 2.6.9 update: *

Vendor	Apache (`b0303047-b7dd-5cf8-abcc-71b7d9d80b95`)
Product	Cxf (`50f1d7f0-1ad2-57a6-bb7b-0f9ea8944dab`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:apache/cxf`	purl2cpe	2026-06-01 10:14:23.700765
`pkg:github/apache/cxf`	purl2cpe	2026-06-01 10:14:23.700766
`pkg:maven/org.apache.cxf/cxf`	purl2cpe	2026-06-01 10:14:23.700768
`pkg:rpm/fedora/cxf`	purl2cpe	2026-06-01 10:14:23.700769

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2014-0110`	vulnerable	2026-06-08 05:05:11.540548	Details available Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (/tmp disk consumption) via a large invalid SOAP message. Published: 2014-05-08T14:00:00.000Z Updated: 2024-08-06T09:05:38.936Z Open on db.gcve.eu Reference links http://cxf.apache.org/security-advisories.data/CVE-2014-0110.txt.asc?version=1&modificationDate=1398873378628&api=v2 http://rhn.redhat.com/errata/RHSA-2015-0850.html http://rhn.redhat.com/errata/RHSA-2015-0851.html http://www.securitytracker.com/id/1030202 http://rhn.redhat.com/errata/RHSA-2014-1351.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-0109`	vulnerable	2026-06-08 05:05:11.537618	Details available Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (memory consumption) via a large request with the Content-Type set to text/html to a SOAP endpoint, which triggers an error. Published: 2014-05-08T14:00:00.000Z Updated: 2024-08-06T09:05:38.268Z Open on db.gcve.eu Reference links http://rhn.redhat.com/errata/RHSA-2015-0850.html http://rhn.redhat.com/errata/RHSA-2015-0851.html https://cxf.apache.org/security-advisories.data/CVE-2014-0109.txt.asc?version=1&modificationDate=1398873370740&api=v2 http://www.securitytracker.com/id/1030201 http://rhn.redhat.com/errata/RHSA-2014-1351.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-0035`	vulnerable	2026-06-08 05:05:10.852331	Details available The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken, transmits the UsernameToken in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network. Published: 2014-07-07T14:00:00.000Z Updated: 2024-08-06T08:58:26.618Z Open on db.gcve.eu Reference links http://rhn.redhat.com/errata/RHSA-2014-0798.html http://rhn.redhat.com/errata/RHSA-2015-0850.html http://cxf.apache.org/security-advisories.data/CVE-2014-0035.txt.asc http://rhn.redhat.com/errata/RHSA-2014-0797.html http://rhn.redhat.com/errata/RHSA-2015-0851.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-0034`	vulnerable	2026-06-08 05:05:10.845330	Details available The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not properly validate SAML tokens when caching is enabled, which allows remote attackers to gain access via an invalid SAML token. Published: 2014-07-07T14:00:00.000Z Updated: 2024-08-06T08:58:26.633Z Open on db.gcve.eu Reference links http://rhn.redhat.com/errata/RHSA-2014-0798.html http://cxf.apache.org/security-advisories.data/CVE-2014-0034.txt.asc http://www.securityfocus.com/bid/68441 http://svn.apache.org/viewvc?view=revision&revision=1551228 http://rhn.redhat.com/errata/RHSA-2015-0850.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.