CVE-2016-0734

The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a 1 FRAME or 2 IFRAME element...

CVE-2016-0734

The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a 1 FRAME or 2 IFRAME element...

Design/Logic Flaw

The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a 1 FRAME or 2 IFRAME element...

CVE-2016-0734

The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a 1 FRAME or 2 IFRAME element...

CVE-2016-0734

CVE-2016-0734 affects Apache ActiveMQ 5.x before 5.13.2. The vulnerability arises because the web-based Admin Console does not send the X-Frame-Options header, enabling clickjacking via a crafted page containing FRAME/IFRAME elements. Connected IBM/industry reports corroborate the CVE and tie rem...

CVE-2016-0734

The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a 1 FRAME or 2 IFRAME element...

CVE-2016-0734

The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a 1 FRAME or 2 IFRAME element...

CVE-2016-0734: Undefined Security Weakness

The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a 1 FRAME or 2 IFRAME element...

PT-2016-1672

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ versions 5.x before 5.13.2 Description The issue is related to the web-based administration console in Apache ActiveMQ, which does not send an X-Frame-Options HTTP header. This makes it easier for remote attackers to conduct...

FreeBSD : activemq -- Web Console XSS (a6cc5753-f29e-11e5-b4a9-ac220bdcec59)

Vladimir Ivanov Positive Technologies reports : Several instances of cross-site scripting vulnerabilities were identified to be present in the web-based administration console as well as the ability to trigger a Java memory dump into an arbitrary folder. The root cause of these issues are imprope...

FreeBSD : activemq -- Unsafe deserialization (a258604d-f2aa-11e5-b4a9-ac220bdcec59)

Alvaro Muatoz, Matthias Kaiser and Christian Schneider reports : JMS Object messages depends on Java Serialization for marshaling/unmashaling of the message payload. There are a couple of places inside the broker where deserialization can occur, like web console or stomp object message...

FreeBSD : activemq -- Web Console Clickjacking (950b2d60-f2a9-11e5-b4a9-ac220bdcec59)

Michael Furman reports : The web-based administration console does not set the X-Frame-Options header in HTTP responses. This allows the console to be embedded in a frame or iframe which could then be used to cause a user to perform an unintended action in the console. %NASLMINLEVEL 70300 C Tenab...

Important: Red Hat Security Advisory: Red Hat OpenShift Enterprise 2.2.9 security, bug fix, and enhancement update

Red Hat OpenShift Enterprise release 2.2.9, which fixes several security issues, several bugs, and introduces feature enhancements, is now available. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which giv...

Debian DSA-3524-1 : activemq - security update

It was discovered that the ActiveMQ Java message broker performs unsafe deserialisation. For additional information, please refer to the upstream advisory at http://activemq.apache.org/security-advisories.data/CVE-2015-5254-anno uncement.txt. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. T...

[SECURITY] [DSA 3524-1] activemq security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3524-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff March 20, 2016 https://www.debian.org/security/faq -...

Debian Security Advisory DSA 3524-1 (activemq - security update)

It was discovered that the ActiveMQ Java message broker performs unsafe deserialisation. For additional information, please refer to the upstream advisory at http://activemq.apache.org/security-advisories.data/CVE-2015-5254-announcement.txt . OpenVAS Vulnerability Test $Id: deb3524.nasl 6608...

DSA-3524-1 activemq - security update

Bulletin has no description...

Debian: Security Advisory (DSA-3524-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Apache ActiveMQ 5.x < 5.13.2 Multiple Vulnerabilities

The version of Apache ActiveMQ running on the remote host is 5.x prior to 5.13.2. It is, therefore, affected by multiple vulnerabilities : - A clickjacking vulnerability exists in the web-based administration console due to not setting the X-Frame-Options header in HTTP responses. A remote attack...

Apache ActiveMQ Web Console Missing X-Frame-Options Clickjacking

The version of Apache ActiveMQ running on the remote host is affected by a clickjacking vulnerability in the web-based administration console due to not setting the X-Frame-Options header in HTTP responses. A remote attacker can exploit this to trick a user into executing administrative tasks. No...