Santuario Xml Security For Java
Vendor:
First CVE: Aug 20, 2013 · Active for 12 years
6
Total CVEs
More Total CVEs than 80% of tracked products
1.0
Avg CVEs / Year
Bottom 1%
5.5
Avg CVSS
Higher Avg CVSS than 15% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Santuario Xml Security For Java over time
Volume of CVEsAvg CVSS Base Score
First CVE
Aug 20, 2013
12 years ago
Most Recent CVE
Oct 20, 2023
1,007 days ago
CVE Severity & Scoring
Santuario Xml Security For Java6 CVEs
83%
17%
All CVEs352,101 CVEs
45%
40%
11%
MediumHigh
Attack Vector
Local1 (16.7%)
Network2 (33.3%)
Unknown3 (50.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low3 (50.0%)
High0 (0.0%)
Unknown3 (50.0%)
User Interaction
None3 (50.0%)
Unknown3 (50.0%)
Required0 (0.0%)
Privileges Required
Low2 (33.3%)
High0 (0.0%)
None1 (16.7%)
Unknown3 (50.0%)
Top CVEs
Signals from CVEs in this product scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-40690HIGH All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when crea | Sep 19, 2021 | 7.5 | 28 | NO | NO |
CVE-2019-12400MEDIUM In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, | Aug 23, 2019 | 5.5 | 21 | NO | NO |
CVE-2023-44483MEDIUM All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclos | Oct 20, 2023 | 6.5 | 20 | NO | NO |
CVE-2014-8152MEDIUM Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attackers to bypass the streaming XML signature protection mechanism via a crafted XML document. | Jan 21, 2015 | 5.0 | 19 | NO | NO |
CVE-2013-4517MEDIUM Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service (memory consumption) via crafted Document Type D | Jan 11, 2014 | 4.3 | 16 | NO | NO |
CVE-2013-2172MEDIUM jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to s | Aug 20, 2013 | 4.3 | 15 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (6 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (6 CVEs).
Media Mentions
Signals from CVEs in this product scope (6 CVEs).
Top CNAs Publishing CVEs For Santuario Xml Security For Java
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 2.0.2 | 1 | 5.0 | 5.6% | 0 | 0 |
| 2.0.1 | 1 | 5.0 | 5.6% | 0 | 0 |
| 2.0.0 | 1 | 5.0 | 5.6% | 0 | 0 |
| 1.5.4 | 2 | 4.3 | 7.4% | 0 | 0 |
| 1.5.3 | 2 | 4.3 | 7.4% | 0 | 0 |
| 1.5.2 | 2 | 4.3 | 7.4% | 0 | 0 |
| 1.5.1 | 2 | 4.3 | 7.4% | 0 | 0 |
| 1.5.0 | 2 | 4.3 | 7.4% | 0 | 0 |
| 1.4.8 | 1 | 4.3 | 8.9% | 0 | 0 |
| 1.4.7 | 2 | 4.3 | 7.4% | 0 | 0 |
| 1.4.6 | 1 | 4.3 | 8.9% | 0 | 0 |
| 1.4.5 | 1 | 4.3 | 8.9% | 0 | 0 |
| 1.4.4 | 1 | 4.3 | 8.9% | 0 | 0 |
| 1.4.3 | 1 | 4.3 | 8.9% | 0 | 0 |
| 1.4.2 | 1 | 4.3 | 8.9% | 0 | 0 |
| 1.4.1 | 1 | 4.3 | 8.9% | 0 | 0 |
| 1.4.0 | 1 | 4.3 | 8.9% | 0 | 0 |
| 1.3.0 | 1 | 4.3 | 8.9% | 0 | 0 |
| 1.2.1 | 1 | 4.3 | 8.9% | 0 | 0 |
| 1.2.0 | 1 | 4.3 | 8.9% | 0 | 0 |