GHSA-V3XW-C963-F5HC jackson-databind mishandles the interaction between serialization gadgets and typing

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq. aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms...

Cross-site Scripting (XSS)

activemq-web-console is vulnerable to cross-site scripting XSS. The vulnerability exists as the values of row.properties in browse.jsp is not properly validated, allowing a remote attacker to inject and execute arbitrary Javascript into a user's browser via the affected parameters...

Apache ActiveMQ Cross-Site Scripting Vulnerability (CNVD-2020-41504)

Apache ActiveMQ is the United States Apache Apache Software Foundation of a set of open source messaging middleware , which supports Java messaging services , clustering , Spring Framework and so on. A cross-site scripting vulnerability exists in the webconsole admin GUI in Apache ActiveMQ versio...

CVE-2020-1941

In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue...

DEBIAN-CVE-2020-1941

In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue...

CVE-2020-1941

In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue...

UBUNTU-CVE-2020-1941

In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue...

Open redirect

In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue...

CVE-2020-1941

In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue...

CVE-2020-1941

CVE-2020-1941 affects Apache ActiveMQ (versions 5.0.0–5.15.11). The connected Nessus entry for this CVE confirms an XSS flaw in the ActiveMQ web console (admin GUI) specifically in the view that lists the contents of a queue. Root cause details are not elaborated beyond the XSS indication in the ...

CVE-2020-1941

In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue...

CVE-2020-1941

In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue...

PT-2020-3257 · Apache · Apache Activemq

Name of the Vulnerable Software and Affected Versions: Apache ActiveMQ versions 5.0.0 through 5.15.11 Description: The issue is related to a lack of input data sanitization in the webconsole admin GUI of Apache ActiveMQ, which makes it susceptible to cross-site scripting XSS attacks. Specifically...

OpenNMS Group OpenNMS Code Issues Vulnerabilities

OpenNMS Group OpenNMS is an open source enterprise network monitoring and network management platform from OpenNMS Group, Inc. OpenNMS Horizon and Meridian are different versions of OpenNMS. A security vulnerability exists in the ActiveMQ channel configuration in OpenNMS Horizon versions prior to...

CVE-2020-12760

An issue was discovered in OpenNMS Horizon before 26.0.1, and Meridian before 2018.1.19 and 2019 before 2019.1.7. The ActiveMQ channel configuration allowed for arbitrary deserialization of Java objects aka ActiveMQ Minion payload deserialization, leading to remote code execution for any...

CVE-2020-12760

An issue was discovered in OpenNMS Horizon before 26.0.1, and Meridian before 2018.1.19 and 2019 before 2019.1.7. The ActiveMQ channel configuration allowed for arbitrary deserialization of Java objects aka ActiveMQ Minion payload deserialization, leading to remote code execution for any...

Deserialization of untrusted data

An issue was discovered in OpenNMS Horizon before 26.0.1, and Meridian before 2018.1.19 and 2019 before 2019.1.7. The ActiveMQ channel configuration allowed for arbitrary deserialization of Java objects aka ActiveMQ Minion payload deserialization, leading to remote code execution for any...

CVE-2020-12760

An issue was discovered in OpenNMS Horizon before 26.0.1, and Meridian before 2018.1.19 and 2019 before 2019.1.7. The ActiveMQ channel configuration allowed for arbitrary deserialization of Java objects aka ActiveMQ Minion payload deserialization, leading to remote code execution for any...

CVE-2020-12760

This CVE concerns OpenNMS Horizon (before 26.0.1) and Meridian (before 2018.1.19 and before 2019.1.7) where ActiveMQ channel configuration enabled arbitrary Java deserialization (ActiveMQ Minion payload deserialization), enabling remote code execution for any authenticated channel user. Affected ...

Oracle Identity Manager Connector Multiple Vulnerabilities (April 2020 CPU)

The remote host is missing the April 2020 Critical Patch Update for Oracle Identity Manager Connector. It is, therefore, affected by multiple vulnerabilities: - Vulnerability in the Identity Manager Connector product of Oracle Fusion Middleware component: General Apache ActiveMQ. The supported...