title: Red Hat Security Advisory: Fuse ESB Enterprise 7.1.0 update
description: Security: Ability to determine if username is valid via DaoAuthenticationProvider apache-cxf: Bypass of security constraints on WS endpoints when using WSS4JInInterceptor apache-cxf: UsernameTokenPolicyValidator and UsernameTokenInterceptor allow empty passwords to authenticate
cpes: cpe:/a:redhat:fuse_esb_enterprise:7.1.0