Apache Axis2/Java vulnerabilities
5 known vulnerabilities in Apache Axis2/Java from Apache. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
Apache Axis2/Java: Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The multipart/form-data and application/x-www-form-urlencoded message builders read the request body directly from the transport stream with no size limit, so the servlet
- 9.1 Critical severity
Apache Axis2/Java: Server-Side Request Forgery
Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. An unauthenticated caller could supply a non-anonymous WS-Addressing wsa:ReplyTo or wsa:FaultTo address, and Axis2 would open a connection to that address to deliver the response or fault,
- 9.1 Critical severity
Apache Axis2/Java: Improper Restriction of XML External Entity Reference
Improper Restriction of XML External Entity Reference vulnerability in Apache Axis2/Java. When a client built an AxisService from a WSDL URL, through ServiceClient or AxisService.createClientSideAxisService, wsdl4j import resolution was enabled and the documen
- 7.5 High severity
Apache Axis2/Java: Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The JSON message builders, including the Gson, Moshi and HTTP/2 variants, buffered the entire request body with no size limit, so an unauthenticated caller could exhaust s
- 9.8 Critical severity
Apache Axis2/Java: Deserialization of Untrusted Data
Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat (only when Tribes clustering is enabled, which is off by default) allows an unauthenticated remo