1371 matches found
JMS Support Online module, 2.0.0, XSS (Cross Site Scripting)
JMS Support Online module,2.0.0,XSS Cross Site Scripting...
The use of anti-serialization vulnerabilities get rid of your JMS-vulnerability warning-the black bar safety net
Description Java deserialization vulnerability we should all be very familiar with, presumably, everyone hands have a variety of uses of such vulnerability tool. It is known to be 2 0 1 5 years is to underestimate the“destruction of the king of the”visible its effects. Java deserialization...
CVE-2016-4978
The getObject method of the javax.jms.ObjectMessage class in the 1 JMS Core client, 2 Artemis broker, and 3 Artemis REST component in Apache ActiveMQ Artemis before 1.4.0 might allow remote authenticated users with permission to send messages to the Artemis broker to deserialize arbitrary objects...
Path traversal
The getObject method of the javax.jms.ObjectMessage class in the 1 JMS Core client, 2 Artemis broker, and 3 Artemis REST component in Apache ActiveMQ Artemis before 1.4.0 might allow remote authenticated users with permission to send messages to the Artemis broker to deserialize arbitrary objects...
CVE-2016-4978
CVE-2016-4978 affects Apache ActiveMQ Artemis (JMS ObjectMessage getObject) where deserialization of untrusted input can occur via gadget classes on Artemis classpath. Affected components include the JMS Core client, Artemis broker, and Artemis REST component in Artemis before 1.4.0. Successful e...
CVE-2016-6194
ObjectMessages in JMS can be used to transfer arbitrary Java objects which are then deserialized before or at the time of being passed on to message listeners...
CVE-2016-4974
Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS AMQP 1.0 before 0.10.0 does not restrict the use of classes available on the classpath, which might allow remote authenticated users with permission to send messages to deserialize arbitrary objects and execute arbitrary code by leveraging a...
CVE-2016-4974
Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS AMQP 1.0 before 0.10.0 does not restrict the use of classes available on the classpath, which might allow remote authenticated users with permission to send messages to deserialize arbitrary objects and execute arbitrary code by leveraging a...
CVE-2016-4974
Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS AMQP 1.0 before 0.10.0 does not restrict the use of classes available on the classpath, which might allow remote authenticated users with permission to send messages to deserialize arbitrary objects and execute arbitrary code by leveraging a...
Design/Logic Flaw
Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS AMQP 1.0 before 0.10.0 does not restrict the use of classes available on the classpath, which might allow remote authenticated users with permission to send messages to deserialize arbitrary objects and execute arbitrary code by leveraging a...
CVE-2016-4974
Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS AMQP 1.0 before 0.10.0 does not restrict the use of classes available on the classpath, which might allow remote authenticated users with permission to send messages to deserialize arbitrary objects and execute arbitrary code by leveraging a...
CVE-2016-4974
Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS AMQP 1.0 before 0.10.0 does not restrict the use of classes available on the classpath, which might allow remote authenticated users with permission to send messages to deserialize arbitrary objects and execute arbitrary code by leveraging a...
de.dentrassi.kura.amqp:de.dentrassi.kura.camel.amqp.runtime (0.0.2), net.smolok:smolok-bootstrap (>=0.0.0, <=0.0.11) +16 more potentially affected by CVE-2016-4974 via org.apache.qpid:qpid-jms-client (>=0.1.0, <=0.9.0)
org.apache.qpid:qpid-jms-client MAVEN version =0.1.0, =0.0.0, =0.0.0, =0.0.6, =0.0.0, =0.0.0, =0.0.6, =0.0.0, =0.0.3, =0.0.4, =0.0.0, =0.0.0, =1.1.0, =1.2.0, =1.4.0 and more Source cves: CVE-2016-4974 Source advisory: MEND:CVE-2016-4974...
CVE-2016-4974
CVE-2016-4974 affects Apache Qpid AMQP 0-x JMS client prior to 6.0.4 and JMS (AMQP 1.0) prior to 0.10.0. The root cause is insufficient restriction of classes on the classpath, allowing remote authenticated users to deserialize arbitrary objects via a crafted JMS ObjectMessage handled by getObjec...
PT-2016-6203
Name of the Vulnerable Software and Affected Versions Apache Qpid AMQP 0-x JMS client versions prior to 6.0.4 Apache Qpid JMS AMQP 1.0 versions prior to 0.10.0 Description The issue allows remote authenticated users with permission to send messages to deserialize arbitrary objects and execute...
CVE-2016-4974: Improper Input Validation
Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS AMQP 1.0 before 0.10.0 does not restrict the use of classes available on the classpath, which might allow remote authenticated users with permission to send messages to deserialize arbitrary objects and execute arbitrary code by leveraging a...
CVE-2016-0271
The agents in IBM UrbanCode Deploy 6.x before 6.0.1.14, 6.1.x before 6.1.3.3, and 6.2.x before 6.2.1.1 do not verify a server's identity in a JMS session or an HTTP session, which allows local users to obtain root access to arbitrary agents via unspecified vectors...
Session fixation
The agents in IBM UrbanCode Deploy 6.x before 6.0.1.14, 6.1.x before 6.1.3.3, and 6.2.x before 6.2.1.1 do not verify a server's identity in a JMS session or an HTTP session, which allows local users to obtain root access to arbitrary agents via unspecified vectors...
PT-2016-4120
Name of the Vulnerable Software and Affected Versions IBM UrbanCode Deploy versions 6.0.0 through 6.0.1.13 IBM UrbanCode Deploy versions 6.1.0 through 6.1.3.2 IBM UrbanCode Deploy versions 6.2.0 through 6.2.1.0 Description The issue allows local users to obtain root access to arbitrary agents via...
CVE-2016-0271: Undefined Security Weakness
The agents in IBM UrbanCode Deploy 6.x before 6.0.1.14, 6.1.x before 6.1.3.3, and 6.2.x before 6.2.1.1 do not verify a server's identity in a JMS session or an HTTP session, which allows local users to obtain root access to arbitrary agents via unspecified vectors...