Vulnerability Database

289,599

Total vulnerabilities in the database

CVE-2014-0035

The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken, transmits the UsernameToken in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network.

CVSS v2:

  • Severity: Low
  • Score: 4.3
  • AV:N/AC:M/Au:N/C:P/I:N/A:N

CWEs:

OWASP TOP 10:

Software From Fixed in
apache / cxf - 2.6.12.x
apache / cxf 2.6.8 2.6.8.x
apache / cxf 2.6.0 2.6.0.x
apache / cxf 2.6.2 2.6.2.x
apache / cxf 2.6.9 2.6.9.x
apache / cxf 2.6.5 2.6.5.x
apache / cxf 2.6.10 2.6.10.x
apache / cxf 2.6.6 2.6.6.x
apache / cxf 2.6.3 2.6.3.x
apache / cxf 2.6.4 2.6.4.x
apache / cxf 2.6.11 2.6.11.x
apache / cxf 2.6.1 2.6.1.x
apache / cxf 2.6.7 2.6.7.x
apache / cxf 2.7.3 2.7.3.x
apache / cxf 2.7.5 2.7.5.x
apache / cxf 2.7.6 2.7.6.x
apache / cxf 2.7.9 2.7.9.x
apache / cxf 2.7.0 2.7.0.x
apache / cxf 2.7.4 2.7.4.x
apache / cxf 2.7.1 2.7.1.x
apache / cxf 2.7.8 2.7.8.x
apache / cxf 2.7.7 2.7.7.x
apache / cxf 2.7.2 2.7.2.x
redhat / jboss_enterprise_application_platform 6.0.0 6.0.0.x
redhat / jboss_enterprise_application_platform 6.2.0 6.2.0.x
org.apache.cxf / cxf-core - 2.6.13
org.apache.cxf / cxf-core 2.7.0 2.7.10