Apache Axis vulnerabilities

Latest Apache Axis CVEs

Newest publication first

1. CVE-2023-40743 Apache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getService

   Published 2023-09-05

   Critical·CVSS 9.8

   ** UNSUPPORTED WHEN ASSIGNED ** When integrating Apache Axis 1.x in an application, it may not have been obvious that looking up a service through "ServiceFactory.getService" allows potentially dangerous lookup mechanisms such as LDAP. When passing untrusted input to this API met...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.