Apache XML Security For C++ vulnerabilities

6 CVEs affecting Apache XML Security For C++, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2013-2210, published 2013-08-20.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2013-2156, published 2013-08-20. High severity, CVSS 7.5. EPSS: 8.4% chance of exploitation in the next 30 days. Heap-based buffer overflow in the Exclusive Canonicalization functionality (xsec/canon/XSECC14n20010315.cpp) in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 allows remote…
CVE-2013-2154, published 2013-08-20. High severity, CVSS 7.5. EPSS: 8% chance of exploitation in the next 30 days. Stack-based buffer overflow in the XML Signature Reference functionality (xsec/dsig/DSIGReference.cpp) in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 allows…
CVE-2011-2516, published 2011-07-11. Medium severity, CVSS 5.0. EPSS: 7.7% chance of exploitation in the next 30 days. Off-by-one error in the XML signature feature in Apache XML Security for C++ 1.6.0, as used in Shibboleth before 2.4.3 and possibly other products, allows remote attackers to cause a denial of…
CVE-2013-2210, published 2013-08-20. High severity, CVSS 7.5. EPSS: 6% chance of exploitation in the next 30 days. Heap-based buffer overflow in the XML Signature Reference functionality in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.2 allows context-dependent attackers to cause a denial…
CVE-2013-2155, published 2013-08-20. Medium severity, CVSS 5.8. EPSS: 5.8% chance of exploitation in the next 30 days. Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 does not properly validate length values, which allows remote attackers to cause a denial of service or bypass the…
CVE-2013-2153, published 2013-08-20. Medium severity, CVSS 4.3. EPSS: 4.8% chance of exploitation in the next 30 days. The XML digital signature functionality (xsec/dsig/DSIGReference.cpp) in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 allows context-dependent attackers to reuse signatures…