Apache AXIS2 vulnerabilities
6 CVEs affecting Apache AXIS2, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2012-5785, published 2012-11-04.
More from Apache.
Highest priority
Known exploited (CISA KEV) first, then by EPSS exploit probability.
- CVE-2010-0219, published 2010-10-18. High severity, CVSS 10.0. EPSS: 90.9% chance of exploitation in the next 30 days. Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account, which makes it easier…
- CVE-2010-2103, published 2010-05-27. Medium severity, CVSS 4.3. EPSS: 34.9% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in axis2-admin/axis2-admin/engagingglobally in the administration console in Apache Axis2/Java 1.4.1, 1.5.1, and possibly other versions, as used in SAP…
- CVE-2010-1632, published 2010-06-22. High severity, CVSS 7.5. EPSS: 22.4% chance of exploitation in the next 30 days. Apache Axis2 before 1.5.2, as used in IBM WebSphere Application Server (WAS) 7.0 through 7.0.0.12, IBM Feature Pack for Web Services 6.1.0.9 through 6.1.0.32, IBM Feature Pack for Web 2.0 1.0.1.0,…
- CVE-2012-4418, published 2012-10-09. Medium severity, CVSS 5.8. EPSS: 6% chance of exploitation in the next 30 days. Apache Axis2 allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."
- CVE-2012-5351, published 2012-10-09. Medium severity, CVSS 6.4. EPSS: 5.1% chance of exploitation in the next 30 days. Apache Axis2 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack," a different vulnerability…
- CVE-2012-5785, published 2012-11-04. Medium severity, CVSS 5.8. EPSS: 2.2% chance of exploitation in the next 30 days. Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows…