Vulnerability Database

296,147

Total vulnerabilities in the database

CVE-2014-0035

The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken, transmits the UsernameToken in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network.

CVSS v2:

  • Severity: Low
  • Score: 4.3
  • AV:N/AC:M/Au:N/C:P/I:N/A:N

CWEs:

OWASP TOP 10:

Software From Fixed in
apache / cxf - 2.6.12.x
apache / cxf 2.6.8 2.6.8.x
apache / cxf 2.6.0 2.6.0.x
apache / cxf 2.6.2 2.6.2.x
apache / cxf 2.6.9 2.6.9.x
apache / cxf 2.6.5 2.6.5.x
apache / cxf 2.6.10 2.6.10.x
apache / cxf 2.6.6 2.6.6.x
apache / cxf 2.6.3 2.6.3.x
apache / cxf 2.6.4 2.6.4.x
apache / cxf 2.6.11 2.6.11.x
apache / cxf 2.6.1 2.6.1.x
apache / cxf 2.6.7 2.6.7.x
apache / cxf 2.7.3 2.7.3.x
apache / cxf 2.7.5 2.7.5.x
apache / cxf 2.7.6 2.7.6.x
apache / cxf 2.7.9 2.7.9.x
apache / cxf 2.7.0 2.7.0.x
apache / cxf 2.7.4 2.7.4.x
apache / cxf 2.7.1 2.7.1.x
apache / cxf 2.7.8 2.7.8.x
apache / cxf 2.7.7 2.7.7.x
apache / cxf 2.7.2 2.7.2.x
redhat / jboss_enterprise_application_platform 6.0.0 6.0.0.x
redhat / jboss_enterprise_application_platform 6.2.0 6.2.0.x
Maven icon org.apache.cxf / cxf-core - 2.6.13
Maven icon org.apache.cxf / cxf-core 2.7.0 2.7.10