A "practical attack against XML's cipher block chaining (CBC) mode" has been demonstrated: XML Encryption Flaw Leaves Web Services Vulnerable. Does this weakness of CBC-mode which is used here also ...
I think I once faced the recommendation, that the initialization vector should always be random and never be used twice with the same key. How serious is this weakness? Also, is AES less effected ...