Description

The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken, transmits the UsernameToken in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network.

Remediation

References

CVE-2014-0035

Related Vulnerabilities

WordPress Plugin RestroPress-Online Food Ordering System Security Bypass (2.8.3)

WordPress Plugin Default Thumbnail Plus Arbitrary File Upload (1.0.2.3)

WordPress Plugin Ecommerce-Two Factor Authentication Cross-Site Scripting (1.0.4)

Jenkins Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2018-1999005)

jQuery UI Dialog Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2010-5312)

Severity

Medium

Classification

CVE-2014-0035

Tags

Missing Update Known Vulnerabilities