ActiveMQ Cron Jobs CVE-2013-1879 HTML注入漏洞

Bugtraq ID:61142 CVE ID:CVE-2013-1879 Apache ActiveMQ是一款开源消息总线，支持JMS1.1和J2EE 1.4规范的JMS Provider实现 Apache ActiveMQ处理cron作业时没有对用户提交的某些参数进行过滤，允许攻击者利用漏洞注入任意HTML和脚本代码，当恶意数据被查看时，可获取用户敏感信息或劫持用户会话 0 Apache ActiveMQ 5.8.0 厂商解决方案 用户可参考如下厂商提供的安全公告获得补丁信息： https://issues.apache.org/jira/browse/AMQ-4397...

ActiveMQ: XSS vulnerability in portfolioPublish demo application

Cross-site scripting XSS vulnerability in the Portfolio publisher servlet in the demo web application in Apache ActiveMQ before 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the refresh parameter to demo/portfolioPublish, a different vulnerability than CVE-2012-6092...

activemq: Multiple XSS flaws in web demos

Multiple cross-site scripting XSS vulnerabilities in the web demos in Apache ActiveMQ before 5.8.0 allow remote attackers to inject arbitrary web script or HTML via 1 the refresh parameter to PortfolioPublishServlet.java aka demo/portfolioPublish or Market Data Publisher, or vectors involving 2...

Important: Red Hat Security Advisory: Fuse MQ Enterprise 7.1.0 update

Fuse MQ Enterprise 7.1.0 roll up patch 1, which fixes multiple security issues and various bugs, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores,...

ActiveMQ: XSS vulnerability in scheduled.jsp

Cross-site scripting XSS vulnerability in scheduled.jsp in Apache ActiveMQ 5.8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving the "cron of a message."...

activemq: Unauthenticated access to web console

The web console in Apache ActiveMQ before 5.8.0 does not require authentication, which allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests...

Apache ActiveMQ Multiple Vulnerabilities

Apache ActiveMQ is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:activemq";...

Apache ActiveMQ WEB控制台 远程拒绝服务或信息泄露漏洞(CVE-2013-3060)

CVE ID:CVE-2013-3060 Apache ActiveMQ是一款开源消息总线，支持JMS1.1和J2EE 1.4规范的JMS Provider实现。 Apache ActiveMQ WEB控制台无需验证，允许远程攻击者利用漏洞提交HTTP请求获得敏感信息或进行拒绝服务攻击。 0 Apache ActiveMQ 5.8.0之前版本 厂商解决方案 Apache ActiveMQ 5.8.0已经修复此漏洞，建议用户下载更新： https://activemq.apache.org/...

Apache ActiveMQ CVE-2012-6551远程拒绝服务漏洞

CVE ID:CVE-2012-6551 Apache ActiveMQ是一款开源消息总线，支持JMS1.1和J2EE 1.4规范的JMS Provider实现。 默认配置下Apache ActiveMQ启用一个简单的WEB应用，允许远程攻击者利用漏洞提交HTTP请求消耗broker资源而造成拒绝服务攻击。 0 Apache ActiveMQ 5.8.0之前版本 厂商解决方案 Apache ActiveMQ 5.8.0已经修复此漏洞，建议用户下载更新： https://activemq.apache.org/...

Apache ActiveMQ web demos多个跨站脚本漏洞(CVE-2012-6092)

CVE ID:CVE-2012-6092 Apache ActiveMQ是一款开源消息总线，支持JMS1.1和J2EE 1.4规范的JMS Provider实现。 Apache ActiveMQ web demos存在多个跨站脚本漏洞，允许远程攻击者通过PortfolioPublishServlet.java的refresh参数也即/demo/portfolioPublish或Market Data...

CVE-2012-6092

Multiple cross-site scripting XSS vulnerabilities in the web demos in Apache ActiveMQ before 5.8.0 allow remote attackers to inject arbitrary web script or HTML via 1 the refresh parameter to PortfolioPublishServlet.java aka demo/portfolioPublish or Market Data Publisher, or vectors involving 2...

CVE-2012-6551

The default configuration of Apache ActiveMQ before 5.8.0 enables a sample web application, which allows remote attackers to cause a denial of service broker resource consumption via HTTP requests...

CVE-2013-3060

The web console in Apache ActiveMQ before 5.8.0 does not require authentication, which allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the web demos in Apache ActiveMQ before 5.8.0 allow remote attackers to inject arbitrary web script or HTML via 1 the refresh parameter to PortfolioPublishServlet.java aka demo/portfolioPublish or Market Data Publisher, or vectors involving 2...

Default configuration

The default configuration of Apache ActiveMQ before 5.8.0 enables a sample web application, which allows remote attackers to cause a denial of service broker resource consumption via HTTP requests...

CVE-2012-6092

Multiple cross-site scripting XSS vulnerabilities in the web demos in Apache ActiveMQ before 5.8.0 allow remote attackers to inject arbitrary web script or HTML via 1 the refresh parameter to PortfolioPublishServlet.java aka demo/portfolioPublish or Market Data Publisher, or vectors involving 2...

CVE-2013-3060

The web console in Apache ActiveMQ before 5.8.0 does not require authentication, which allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests...

Authentication flaw

The web console in Apache ActiveMQ before 5.8.0 does not require authentication, which allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests...

CVE-2012-6551

The default configuration of Apache ActiveMQ before 5.8.0 enables a sample web application, which allows remote attackers to cause a denial of service broker resource consumption via HTTP requests...

CVE-2012-6092

Multiple cross-site scripting XSS vulnerabilities in the web demos in Apache ActiveMQ before 5.8.0 allow remote attackers to inject arbitrary web script or HTML via 1 the refresh parameter to PortfolioPublishServlet.java aka demo/portfolioPublish or Market Data Publisher, or vectors involving 2...