Axis2/Java (< 2.0.2)

Apache Axis2/Java versions prior to 2.0.2 are vulnerable to unauthenticated SSRF, allowing attackers to force the server to initiate requests to arbitrary network destinations.

Apache Axis2/Java version 2.0.1 contains a cross-site scripting (XSS) vulnerability in its OpenAPI module caused by improper sanitization of the Host header.

Apache Axis2/Java versions prior to 2.0.2 are vulnerable to a denial-of-service condition where unauthenticated attackers can exhaust server memory by sending large, unbounded JSON requests.

Apache Axis2/Java contains a forced browsing vulnerability where the exposeServiceMetadata parameter is not enforced on specific routes, allowing unauthorized metadata disclosure.