Apache : Security Vulnerabilities, CVEs, Published In October 2014 (Bypass)
Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors.
Max CVSS
5.0
EPSS Score
0.40%
Published
2014-10-30
Updated
2021-06-16
Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty (1) username or (2) password.
Max CVSS
7.5
EPSS Score
0.64%
Published
2014-10-06
Updated
2014-10-07
2 vulnerabilities found