1705 matches found
Apache ActiveMQ - Remote Code Execution via HTTP Discovery Transport Bypass
Apache ActiveMQ before 5.19.6 and 6.0.0 through 6.2.4 is vulnerable to remote code execution via a bypass of the CVE-2026-34197 security fix. The original fix blocked the "vm://" transport scheme in BrokerView.addNetworkConnector and BrokerView.addConnector to prevent authenticated attackers from...
Apache ActiveMQ <=5.15.5 - Cross-Site Scripting
Apache ActiveMQ versions 5.0.0 to 5.15.5 are vulnerable to cross-site scripting via the web based administration console on the queue.jsp page. The root cause of this issue is improper data filtering of the QueueFilter parameter. id: CVE-2018-8006 info: name: Apache ActiveMQ =5.15.5 - Cross-Site...
Apache ActiveMQ 6.x < 6.1.2 - Broken Access Control
Apache ActiveMQ 6.x contains an unauthenticated API web context caused by default configuration lacking security measures in the Jetty server, letting anyone interact with broker APIs and messaging layers, exploit requires no authentication. id: CVE-2024-32114 info: name: Apache ActiveMQ 6.x 6.1....
ROOT-OS-DEBIAN-11-CVE-2026-34197 CVE-2026-34197 in activemq - Patched by Root
Root has patched CVE-2026-34197 in the activemq package for Root:Debian:11. Multiple fixed versions available...
Apache ActiveMQ < 5.16.5/5.17.3 - Remote Code Execution
Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandlerhandlePostRequest is able to create JmxRequest...
BIT-ACTIVEMQ-2026-59878 Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All: AMQP NIO negative frame size validation bypass leading to DoS
Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All. A remote unauthenticated peer that can reach an exposed AMQP NIO connector can trigger denial-of-service behavior by sending a frame size value. This cause the NIO threads to die and if done...
Apache ActiveMQ - Remote Code Execution
Improper Input Validation, Improper Control of Generation of Code 'Code Injection' vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations o...
The vulnerability of the ActiveMQ NIO SSL module in Apache ActiveMQ products allows a attacker to cause a service failure.
The vulnerability of the ActiveMQ NIO SSL software products of Apache ActiveMQ is related to an uncontrolled resource consumption. Exploiting this vulnerability may allow a malicious actor to cause service failures...
The vulnerability of Apache ActiveMQ software lies in the incorrect path name restrictions for the directory, which allows attackers to compromise the confidentiality of the protected information.
The vulnerability of Apache ActiveMQ software products is related to incorrect restrictions on path names to the directory. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality of the protected information...
The vulnerability in the Apache ActiveMQ and Apache ActiveMQ Web software for web management consoles allows attackers to inject malicious HTML content.
The vulnerability of the Apache ActiveMQ and Apache ActiveMQ Web software for web management consoles is related to the lack of security measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to inject malicious HTML content remotely...
Apache ActiveMQ Fileserver - Arbitrary File Write
Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request via the Fileserver web application. id: CVE-2016-3088 info: name: Apache ActiveMQ Fileserver - Arbitrary File Write author: fqhsu severity: critical...
ROOT-APP-MAVEN-CVE-2026-34197 CVE-2026-34197 in org.apache.activemq:activemq-broker - Patched by Root
Root has patched CVE-2026-34197 in the org.apache.activemq:activemq-broker package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2026-41044 CVE-2026-41044 in org.apache.activemq:activemq-broker - Patched by Root
Root has patched CVE-2026-41044 in the org.apache.activemq:activemq-broker package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2026-40466 CVE-2026-40466 in org.apache.activemq:activemq-broker - Patched by Root
Root has patched CVE-2026-40466 in the org.apache.activemq:activemq-broker package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2026-39304 CVE-2026-39304 in org.apache.activemq:activemq-client - Patched by Root
Root has patched CVE-2026-39304 in the org.apache.activemq:activemq-client package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2026-42588 CVE-2026-42588 in org.apache.activemq:activemq-broker - Patched by Root
Root has patched CVE-2026-42588 in the org.apache.activemq:activemq-broker package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2026-45505 CVE-2026-45505 in org.apache.activemq:activemq-all - Patched by Root
Root has patched CVE-2026-45505 in the org.apache.activemq:activemq-all package for Root:Maven. Multiple fixed versions available...
Improper Input Validation
Apache ActiveMQ is vulnerable to an Improper Input Validation vulnerability. The vulnerability is due to improper validation of negative content-length values in STOMP requests, which allows a remote unauthenticated attacker with access to an exposed STOMP connector to send malicious body data an...