title: Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.1.0 security update
description: CXF: The SecurityTokenService accepts certain invalid SAML Tokens as valid CXF: UsernameTokens are sent in plaintext with a Symmetric EncryptBeforeSigning policy Shiro: successful authentication without specifying user name or password Xalan-Java: insufficient constraints in secure processing feature CXF: HTML content posted to SOAP endpoint could cause OOM errors CXF: Large invalid content could cause temporary space to fill Jolokia: cross-site request forgery (CSRF) netty: DoS via memory exhaustion during data aggregation Framework: Information disclosure via SSRF
cpes: cpe:/a:redhat:jboss_amq:6.1.0 cpe:/a:redhat:jboss_fuse:6.1.0