Exploitation-de-la-vuln-rabilit-CVE-2015-5254-

Exploitation of CVE-2015-5254 Vulnerability CVE-2015-5254 is a security vulnerability in Apache ActiveMQ, a widely used open source message broker for inter-application communication. This vulnerability affects ActiveMQ versions up to 5.13.0 and stems from the lack of filtering on incoming JMS...

ActiveMQ_CVE-2015-5254

ActiveMQ Deserialization CVE-2015-5254 Vulnerability Description: Security vulnerabilities exist in Apache ActiveMQ versions before 5.13.0. The issue stems from the program not restricting the classes that can be serialized in the broker. Remote attackers can exploit this by sending a specially...

RHLW-2026-03CCE96257578D24 Lightwell Security Advisory: cxf-rt-transports-jms 4.2.2.rhlw-00007

Red Hat Lightwell has released org.apache.cxf:cxf-rt-transports-jms 4.2.2.rhlw-00007 with a backported security fix. CVE-2026-66909: Apache CXF: Unsafe deserialization of inbound JMS ObjectMessage This patched artifact is a drop-in replacement for org.apache.cxf:cxf-rt-transports-jms 4.2.2 from...

RHLW-2026-689BBA11EAE91BCB Lightwell Security Advisory: cxf-jaxrs-service 3.6.9.rhlw-00004

Red Hat Lightwell has released org.apache.cxf.archetype:cxf-jaxrs-service 3.6.9.rhlw-00004 with backported fixes for CVE-2026-44417, CVE-2026-50632, and CVE-2026-66909. CVE-2026-44417: Apache CXF: Incomplete fix for CVE-2025-48913 Untrusted JMS configuration can lead to RCE CVE-2026-50632: Apache...

Deserialization Of Untrusted Data

Apache CXF is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to native Java deserialization of inbound JMS ObjectMessage objects without type restrictions, which allows an attacker who can place messages on the JMS destination to submit malicious serialized objects that...

Deserialization Of Untrusted Data

Apache Camel is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to improper deserialization of a crafted JMS ObjectMessage containing an allowed DefaultExchangeHolder object, which bypasses the CVE-2026-40860 class check and allows an attacker who can publish messages to...

Apache camel-jms, camel-sjms, camel-sjms2 and camel-amqp: Unsafe Deserialization of JMS ObjectMessage

JmsBinding.extractBodyFromJms in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject without applying any ObjectInputFilter, class allowlist or class denylist. Because this code path is...

GHSA-M5VH-3FW5-5WGH Apache camel-jms, camel-sjms, camel-sjms2 and camel-amqp: Unsafe Deserialization of JMS ObjectMessage

JmsBinding.extractBodyFromJms in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject without applying any ObjectInputFilter, class allowlist or class denylist. Because this code path is...

CVE-2026-40860

Apache Camel is vulnerable to remote code execution (RCE) due to unsafe deserialization in the camel-jms component and related JMS-family components (including camel-sjms , camel-sjms2 , camel-amqp , camel-activemq , and camel-activemq6 ). The root cause is that JmsBinding.extractBodyFromJms() de...

EUVD-2021-7743

Malicious code in bioql PyPI...

CVE-2021-20318

The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage...

Hardcoded credentials

The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage...

CVE-2021-20318

The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage...

CVE-2021-20318: Deserialization of Untrusted Data

The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage...

PT-2021-13883

Name of the Vulnerable Software and Affected Versions: Artemis in EAP 7 affected versions not specified Description: A flaw in the HornetQ component of Artemis in EAP 7 allows a remote attacker to execute arbitrary code with the permissions of the application using a JMS ObjectMessage...

CVE-2021-20318

The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage...

Red Hat Jboss Enterprise Application Platform 7 Code Issues and Vulnerabilities

Red Hat Jboss Enterprise Application Platform 7 Red Hat Jboss Eap 7 is a middleware platform built on open standards and compatible with the Java Ee 7 specification from Red Hat USA. A code issue vulnerability exists in Red Hat JBoss Enterprise Application Platform 7 Artemis that stems from the...

Security Bulletin: CVE-2015-5254 Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker

Summary CVE-2015-5254 Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service JMS ObjectMessage object. Vulnerability Details CVEID: CVE-2015-5254...

Security Bulletin: Vulnerability in Apache ActiveMQ affects IBM Control Center (CVE-2015-5254)

Summary An Apache ActiveMQ vulnerability for potentially allowing a remote attacker to execute arbitrary code was addressed by IBM Control Center. Control Center is only vulnerable if configured to use JMS Java Messaging Service. Vulnerability Details CVEID: CVE-2015-5254 DESCRIPTION: Apache...

CVE-2016-0276

IBM Financial Transaction Manager FTM for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, Financial Transaction Manager FTM for Check Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, and Financial Transaction Manager FTM for Corporate Payment Services CPS for...