Red Hat Security Advisory: JBoss Enterprise SOA Platform 5.3.0 update
apache-cxf: Apache CXF does not verify that elements were signed / encrypted by a particular Supporting Token
cpe:/a:redhat:jboss_enterprise_soa_platform:5.3