wss4j vulnerabilities

Products

• wss4j/wss4j 2

Latest wss4j CVEs

Newest publication first

1. CVE-2011-2487 Use of a Broken or Risky Cryptographic Algorithm in Apache WSS4J

   Published 2020-03-11

   Medium·CVSS 5.9 EPSS 1.8%

   The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack.

2. CVE-2015-0227 Improper Access Control in Apache WSS4J

   Published 2015-02-12

   Medium·CVSS 5.0 EPSS 7.5%

   Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.