CVE Vulnerability Catalog

Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pattern can get stuck trying many combinations when it encounters a long string without an operator, causing excessive CPU consumption. An attacker can send a crafted query to exhaust server CPU resources, potentially slowing down or stopping other requests. The fix limits FIQL expressions to 4 KiB by default.

Apache CXF's OIDC relying-party component could redirect users to an attacker-controlled URL after successful authentication. The issue occurs because attacker-controlled state parameters are preserved and later used as redirect targets without validating that the final decoded URI belongs to the RP's origin. Both directly encoded and double-encoded external URLs can trigger the issue.

CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap. A small (~KB) crafted payload could expand to gigabytes on the heap. This was reachable via JWE decryption when zip=DEF (e.g., JoseSessionTokenProvider with RSA-OAEP) and via SAML redirect/POST binding token inflation — in both cases decompression happens before or independent of trust validation. The fix adds a configurable maximum inflated-size cap (default 10 MiB).

Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXF allows a remote attacker to obtain multiple valid access tokens from a single authorization code via concurrent token exchange requests that race the non-atomic find-then-delete operation against a shared relational database under READ_COMMITTED isolation.

The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity. Any relying party using setMaxAgeOffset to enforce re-authentication would silently accept sessions of any age, bypassing step-up authentication policies.

By default, StaxUtils placed no limit on the total number of elements or characters in an XML document. A very large request could use a lot of memory and CPU during parsing, especially where CXF builds a DOM from the input (e.g., SAAJ or WS-Security), and could cause a denial of service when no request size limit was configured. Both limits now have defaults: maximum element count is 100 × maxChildElements (5,000,000 by default), and maximum document size is 256M characters.

In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not verify that the hostname in the server's TLS certificate matched the host being called. This applied over both HTTP/1.1 and HTTP/2, even when disableCNCheck was left at its default value of false. The certificate chain was validated against the configured trust store, but the endpoint's identity was not. A network attacker able to intercept traffic could present any certificate trusted by the client, such as a publicly issued certificate for a domain they control, and impersonate the target service. They could then read or modify the exchanged messages, including credentials.

The multipart/MTOM attachment header parser in Apache CXF did not fully enforce the configured size and count limits. The size limit applied only to individual lines, not to values built from continuation lines or combined repeated headers. A remote, unauthenticated attacker could send a request with very large headers, causing unbounded memory allocation and denial of service.

The JAX-RS XML Security module in Apache CXF did not properly verify XML signatures. The XML signature interceptors did not ensure that the XML passed to the application was covered by the signature. An attacker with a document signed by a trusted key could wrap it in unsigned content, which the application would treat as signed.

The EduAdmin Booking plugin (eduadmin-booking) by MultiNet Interactive AB contains an SQL Injection vulnerability (improper neutralization of special elements in SQL commands). It allows an attacker to perform blind SQL injection. This issue affects versions from n/a before 6.0.0.

A Reflected Cross-Site Scripting (XSS) vulnerability in the Welcart e-Commerce usc-e-shop plugin for WordPress, affecting versions up to 2.12.3, allows an attacker to inject malicious scripts into the page.

A Cross-Site Request Forgery (CSRF) vulnerability in the Featured Image from URL plugin for WordPress, affecting versions up to 6.0.7, allows an attacker to force a logged-in user to perform unauthorized actions.

A Reflected Cross-Site Scripting (XSS) vulnerability in the NEX-Forms plugin for WordPress, affecting versions up to 9.3.1, allows an attacker to inject malicious scripts into the page.

A Reflected Cross-Site Scripting (XSS) vulnerability in the FiboSearch plugin for WordPress, affecting versions up to 1.34.1, allows an attacker to inject malicious scripts into the page.

The Ultimate Member plugin for WordPress in versions up to and including 2.13.1 contains an Incorrect Privilege Assignment vulnerability that allows Privilege Escalation. The issue affects all versions from n/a through 2.13.1.

The ProfilePress (wp-user-avatar) plugin contains a Missing Authorization vulnerability caused by incorrectly configured access control. The issue affects versions from n/a through 4.17.3.

A Missing Authorization vulnerability in the Amelia plugin for WordPress, affecting versions up to 2.4.10, allows exploitation of incorrectly configured access control security levels.

The ProfilePress (wp-user-avatar) plugin contains a Missing Authorization vulnerability caused by incorrectly configured access control. The issue affects versions from n/a through 4.17.3.

Authentication bypass by spoofing vulnerability in the Forminator plugin. Affects versions from n/a through 1.57.2.

The ThemeGrill User Registration (user-registration) plugin contains a Missing Authorization vulnerability caused by incorrectly configured access control. The issue affects versions from n/a through 5.2.7.