CVE-2022-41678

CVE-2022-41678: كائنات MBeans خطيرة يمكن الوصول إليها عبر واجهة برمجة تطبيقات Jolokia في Apache ActiveMQ من خلال سرد وفحص كائنات MBeans المكشوفة بواسطة واجهة برمجة تطبيقات Jolokia على http://127.0.0.1:8161/api/jolokia، تم تحديد نواقل الهجوم التالية: كتابة ملفات عشوائية باستخدام Log4J مما يؤدي إلى...

MAL-010

MAL-010: Gefährliche MBeans über JMX in Apache James zugänglich Durch Auflisten und Untersuchen der über JMX auf localhost, Port 9999, exponierten MBeans wurden die folgenden Angriffsvektoren identifiziert: Beliebiges Dateischreiben mit Log4J Beliebiges Dateilesen mit Log4J Hinweis: Anders als de...

CVE-2026-34197

CVE-2026-34197 — Apache ActiveMQ RCE über Jolokia-API Beschreibung CVE-2026-34197 ist eine Schwachstelle zur Remote-Code-Ausführung RCE in Apache ActiveMQ Classic, die es einem Angreifer ermöglicht, beliebige Befehle auf dem Betriebssystem des Servers über die in der Webkonsole exponierte...

CVE-2026-34197

🚨 CVE-2026-34197 — Kritische Jolokia-RCE in Apache ActiveMQ Authentifizierte RCE über Jolokia-MBeans → Remote-Spring-XML → JVM-Codeausführung 📖 Überblick CVE-2026-34197 ist eine authentifizierte Remote-Codeausführungsschwachstelle mit hohem Schweregrad , die Apache ActiveMQ Classic betrifft. Das...

Arbitrary Code Injection

Overview org.apache.activemq:activemq-broker is a high performance Apache 2.0 licensed Message Broker and JMS 1.1 implementation. Affected versions of this package are vulnerable to Arbitrary Code Injection over the /api/jolokia MBeans interface. A user can execute arbitrary code on the broker's...

Arbitrary Code Injection

Overview org.apache.activemq:activemq-broker is a high performance Apache 2.0 licensed Message Broker and JMS 1.1 implementation. Affected versions of this package are vulnerable to Arbitrary Code Injection over the /api/jolokia MBeans interface. A user can execute arbitrary code on the broker's...

Arbitrary Code Injection

Overview org.apache.activemq:activemq-all is a package that puts together an ActiveMQ jar bundle. Affected versions of this package are vulnerable to Arbitrary Code Injection over the /api/jolokia MBeans interface. A user can execute arbitrary code on the broker's JVM by invoking operations with ...

Authenticated Apache ActiveMQ Broker and Apache ActiveMQ users could perform RCE via Jolokia MBeans

Improper Input Validation, Improper Control of Generation of Code 'Code Injection' vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations o...

CVE-2026-34197 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans

Improper Input Validation, Improper Control of Generation of Code 'Code Injection' vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations o...

CVE-2026-34197 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans

Improper Input Validation, Improper Control of Generation of Code 'Code Injection' vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations o...

CVE-2026-34197 Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans

Improper Input Validation, Improper Control of Generation of Code 'Code Injection' vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations o...

CVE-2026-34197

The CVE-2026-34197 issue affects Apache ActiveMQ products (Broker, All, and Core) before 5.19.4 and before 6.2.3 (6.0.0–6.2.3 range). The root cause is improper input validation and insecure control of code generation via the Jolokia JMX-HTTP bridge, which can be abused to load a remote Spring XM...

EUVD-2016-6015

Malware in sbrugna...

EUVD-2018-18790

Malware in sbrugna...

EUVD-2007-1413

Malware in sbrugna...

EUVD-2020-16966

Malware in sbrugna...

EUVD-2011-2881

Malware in sbrugna...

EUVD-2024-2926

Malicious code in bioql PyPI...

CVE-2023-50780

A flaw was found in Apache ActiveMQ Artemis. Affected versions of this package allow access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint. This also included the Log4J2 MBean. This MBean is not meant for exposure to...

GHSA-443J-GRXV-2PGV Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans

Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint. Before version 2.29.0, this also included the Log4J2 MBean. This MBean is not meant for exposure to non-administrative users. This could...