Security Bulletin: Multiple Vulnerabilities affect IBM Sterling Secure Proxy

Summary Three Jetty request smuggling vulnerabilities and an Apache ActiveMQ man-in-the-middle vulnerability were addressed by IBM Sterling Secure Proxy. Vulnerability Details CVE-ID: CVE-2017-7656 Description: Eclipse Jetty is vulnerable to HTTP request smuggling, caused by a flaw in the HTTP/1....

Security Bulletin: Vulnerability in Apache ActiveMQ affects IBM Control Center (CVE-2018-11775)

Summary Apache ActiveMQ Client could allow a remote attacker to conduct a man-in-the-middle attack, caused by a missing TLS hostname verification. An attacker could exploit this vulnerability to launch a man-in-the-middle attack between a Java application using the ActiveMQ client and the ActiveM...

Important: Red Hat Security Advisory: Red Hat AMQ Broker 7.4.4 release and security update

Red Hat AMQ Broker 7.4.4 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

broker: resetUsers operation stores password in plain text

A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis shadow file etc/artemis-users.properties file when executing the resetUsers operation. A local attacker can use this flaw to read the...

Apache ActiveMQ Web console Diagram Plugin Cross-Site Scripting Vulnerability

Apache ActiveMQ is the United States Apache Apache Software Foundation of a set of open source messaging middleware , which supports Java messaging services , clustering , Spring Framework , etc. Web console is one of the Web console . Apache ActiveMQ Artemis version 2.5.0 to 2.13.0 version of th...

CVE-2020-13932

In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console's browser. The XSS payload is triggered in the diagram plugin; queue node and th...

CVE-2020-13932

In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console's browser. The XSS payload is triggered in the diagram plugin; queue node and th...

Cross site scripting

In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console's browser. The XSS payload is triggered in the diagram plugin; queue node and th...

CVE-2020-13932

Summary: CVE-2020-13932 concerns Apache ActiveMQ Artemis 2.5.0–2.13.0 where a specially crafted MQTT packet carrying an XSS payload in the client-id or topic name can be injected into the admin console’s browser via the diagram plugin, affecting the diagram plugin, queue node, and info section in...

CVE-2020-13932

In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console's browser. The XSS payload is triggered in the diagram plugin; queue node and th...

CVE-2020-13932

A flaw was found in activemq. A specifically crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console's browser. The XSS payload is triggered in the diagram plugin; queue node and the info...

PT-2020-13788

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ Artemis versions 2.5.0 through 2.13.0 Description A specially crafted MQTT packet with an XSS payload as client-id or topic name can exploit this issue. The XSS payload is injected into the admin console's browser and is...

Apache ActiveMQ 5.x < 5.15.12 XSS (CVE-2020-1941)

The version of Apache ActiveMQ running on the remote host is 5.x prior to 5.15.12. It is, therefore, affected by a cross-site scripting XSS vulnerability in the webconsole admin GUI. An unauthenticated, remote attacker can exploit this issue, by convincing a user to click a specially crafted URL,...

The vulnerability of the etc/artemis-users.properties component of the asynchronous messaging system Apache ActiveMQ Artemis is related to insufficient protection of registration data, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the etc/artemis-users.properties component in the asynchronous message exchange system using Apache ActiveMQ Artemis is related to insufficient protection of registration data. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected...

ActiveMQ Artemis management API Password Disclosure Vulnerability

Apache ActiveMQ Artemis is the United States Apache Apache Software Foundation, a project to provide embedded messaging services for Java applications. A password disclosure vulnerability exists in the ActiveMQ Artemis management API product, which stems from the program storing passwords in...

CVE-2020-10727

A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis shadow file etc/artemis-users.properties file when executing the resetUsers operation. A local attacker can use this flaw to read the...

CVE-2020-10727

A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis shadow file etc/artemis-users.properties file when executing the resetUsers operation. A local attacker can use this flaw to read the...

Design/Logic Flaw

A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis shadow file etc/artemis-users.properties file when executing the resetUsers operation. A local attacker can use this flaw to read the...

CVE-2020-10727

CVE-2020-10727 affects ActiveMQ Artemis management API from version 2.7.0 up to 2.12.0. The root cause is that during the resetUsers operation, passwords are stored in plaintext in the Artemis shadow file (etc/artemis-users.properties), enabling a local attacker to read the shadow file contents. ...

CVE-2020-10727

A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis shadow file etc/artemis-users.properties file when executing the resetUsers operation. A local attacker can use this flaw to read the...