Arbitrary Command Execution

hawtio-karaf-terminal is vulnerable to arbitrary command execution. Attackers can execute arbitrary commands through the admin terminal as it doesn't require authentication...

Cross-site Request Forgery (CSRF)

hawtio-karaf-terminal is vulnerable to cross-site request forgery CSRF attacks. Attackers can use the authentication of a user to run commands on the Karaf server such as shutdown -f...

The vulnerability in the Hawtio web console of the Apache ActiveMQ software platform allows a perpetrator to obtain confidential information or exert other effects.

The vulnerability of the Hawtio web console of the Apache ActiveMQ software platform is related to security configuration errors. Exploiting this vulnerability can allow a malicious actor, operating remotely, to obtain confidential information or exert other unauthorized actions...

The vulnerability of the Hawtio web console in the Apache ActiveMQ software platform allows a malicious actor to reuse the session identifier of an authenticated user.

The vulnerability of the Hawtio web console in the Apache ActiveMQ software platform stems from the lack of setting the HTTPOnly or Secure attributes for cookie files. Exploiting this vulnerability allows a malicious actor to repeatedly use the authenticated user’s session identifier remotely...

Red Hat JBoss A-MQ Hawtio console security bypass vulnerability

Red Hat JBoss A-MQ is an open source messaging platform from Red Hat, Inc. that integrates applications and devices and provides various messaging modes to support real-time messaging. The platform is used to integrate applications , endpoints and devices , and provides a variety of messaging...

Red Hat JBoss A-MQ Hawtio console information disclosure vulnerability

Red Hat JBoss A-MQ is an open source messaging platform from Red Hat, Inc. that integrates applications and devices and provides various messaging modes to support real-time messaging. The platform is used to integrate applications , endpoints and devices , and provides a variety of messaging...

Hawtio Cross-Site Request Forgery Vulnerability

Hawtio is a Web console for managing Java frameworks. A cross-site request forgery vulnerability exists in Hawtio. A remote attacker could exploit this vulnerability to perform unauthorized operations...

CVE-2017-7556

Hawtio versions up to and including 1.5.3 are vulnerable to CSRF vulnerability allowing remote attackers to trick the user to visit their website containing a malicious script which can be submitted to hawtio server on behalf of the user...

CVE-2017-7556

Hawtio versions up to and including 1.5.3 are vulnerable to CSRF vulnerability allowing remote attackers to trick the user to visit their website containing a malicious script which can be submitted to hawtio server on behalf of the user...

Cross site request forgery (csrf)

Hawtio versions up to and including 1.5.3 are vulnerable to CSRF vulnerability allowing remote attackers to trick the user to visit their website containing a malicious script which can be submitted to hawtio server on behalf of the user...

CVE-2017-7556

Hawtio versions up to and including 1.5.3 are vulnerable to CSRF vulnerability allowing remote attackers to trick the user to visit their website containing a malicious script which can be submitted to hawtio server on behalf of the user...

CVE-2017-7556

CVE-2017-7556 affects hawtio up to version 1.5.3, where a cross-site request forgery (CSRF) vulnerability exists. The issue allows a remote attacker to lure an authenticated user to a malicious site hosting a script that can be submitted to the hawtio server on behalf of that user. The provided c...

hawtio: Proxy is sharing cookies among all the clients

It was discovered that the hawtio servlet uses a single HttpClient instance to proxy requests with a persistent cookie store cookies are stored locally and are not passed between the client and the end URL which means all clients using that proxy are sharing the same cookies...

Important: Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.3 R4 security and bug fix update

An update is now available for Red Hat JBoss Fuse and Red Hat JBoss A-MQ. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

hawtio: information Disclosure flaws due to unsafe path traversal

It was found that a path traversal vulnerability in hawtio leads to a NullPointerException with a full stacktrace. An attacker could use this flaw to gather undisclosed information from within hawtio's root...

CVE-2017-7556

It was found that hawtio contains a CSRF flaw that allows unrelated websites to perform actions as the authenticated user. Attackers could use this vulnerability to trick the user to visit his website that contains a malicious script which can be submitted to hawtio server on behalf of the user...

CVE-2017-2589

It was discovered that the hawtio servlet uses a single HttpClient instance to proxy requests with a persistent cookie store cookies are stored locally and are not passed between the client and the end URL which means all clients using that proxy are sharing the same cookies...

Hawtio Directory Traversal Vulnerability

hawtio is a Web console for managing Java frameworks . A directory traversal vulnerability exists in hawtio due to the program failing to properly filter user-submitted input. A remote attacker can exploit this vulnerability by using directory traversal characters '... /' to access arbitrary file...

Hawtio Arbitrary File Upload Vulnerability

Hawtio is a web management console for managing JAVA. An arbitrary file upload vulnerability exists in Hawtio. An attacker could use this vulnerability to upload arbitrary files to an affected computer, resulting in arbitrary code execution...

CVE-2017-2617

It was found that a flaw in hawtio could cause remote code execution via file upload. An attacker could use this vulnerability to upload crafted file which could be executed on a target machine where hawtio is deployed...