CVE-2016-0734

The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a 1 FRAME or 2 IFRAME element...

Debian Security Advisory DSA 3524-1 (activemq - security update)

It was discovered that the ActiveMQ Java message broker performs unsafe deserialisation. For additional information, please refer to the upstream advisory at http://activemq.apache.org/security-advisories.data/CVE-2015-5254-announcement.txt . OpenVAS Vulnerability Test $Id: deb3524.nasl 6608...

Apache ActiveMQ 5.11.x < 5.11.4 / 5.12.x < 5.12.3 / 5.13.x < 5.13.1 Web Console Multiple XSS

The version of Apache ActiveMQ running on the remote host is 5.11.x prior to 5.11.4, 5.12.x prior to 5.12.3, or 5.x prior to 5.13.1. It is, therefore, affected by multiple cross-site scripting vulnerabilities in the web-based administration console due to improper validation of user-supplied inpu...

Apache ActiveMQ 5.x < 5.13.2 Multiple Vulnerabilities

The version of Apache ActiveMQ running on the remote host is 5.x prior to 5.13.2. It is, therefore, affected by multiple vulnerabilities : - A clickjacking vulnerability exists in the web-based administration console due to not setting the X-Frame-Options header in HTTP responses. A remote attack...

Apache ActiveMQ Shutdown Command Denial of Service (CVE-2014-3576)

A denial of service vulnerability exists in Apache ActiveMQ. The vulnerability is due to missing authentication for the undocumented shutdown command. A remote, unauthenticated attacker may exploit this vulnerability by sending crafted packets to the server. Successful exploitation could lead to ...

Apache ActiveMQ Web Console Cross-Site Scripting Vulnerability

Apache ActiveMQ is a popular messaging and integration model provider . Apache ActiveMQ 5.0.0 - 5.13.1 Multiple cross-site scripting vulnerabilities exist in the Web Management Console and in Java memory dumps due to incorrect user data output validation and improper privilege settings within...

Apache ActiveMQ 5.x < 5.11.2 Blob Message Directory Traversal

Binary data 9079.prm...

Apache ActiveMQ 5.x < 5.13.0 Java Object Unserialization RCE

Binary data 9080.prm...

Code injection

Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service JMS ObjectMessage object...

CVE-2015-5254

Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service JMS ObjectMessage object...

CVE-2015-5254

Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service JMS ObjectMessage object...

CVE-2015-5254

CVE-2015-5254 is a deserialization vulnerability in Apache ActiveMQ 5.x prior to 5.13.0. The broker does not restrict serialized classes, enabling remote attackers to execute arbitrary code via a crafted JMS ObjectMessage. Several connected advisories confirm the issue and note mitigations: upgra...

CVE-2015-5254

Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service JMS ObjectMessage object...

Apache ActiveMQ 5.x < 5.13.0 Java Object Deserialization RCE

The version of Apache ActiveMQ running on the remote host is 5.x prior to 5.13.0. It is, therefore, affected by a remote code execution vulnerability in the broker due to unsafe deserialize calls of unauthenticated Java objects to the Apache Commons Collections ACC library. An unauthenticated,...

The vulnerability of the Apache ActiveMQ software platform, which allows attackers to create JSP files in arbitrary directories.

The vulnerability of the load/data retrieval functions of the Apache ActiveMQ software platform exists due to an incorrect path limitation for the directory with restricted access. Exploiting this vulnerability allows a malicious actor to create JSP files in arbitrary directories remotely...

The vulnerability of the Apache ActiveMQ software platform, which allows a hacker to obtain user credentials

The vulnerability of the LDAPLoginModule implementation and the Java Authentication and Authorization Service components of the Apache ActiveMQ software platform is related to errors in managing registration data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to...

Important: Red Hat Security Advisory: Red Hat JBoss A-MQ 6.2.1 update

Red Hat JBoss A-MQ 6.2.1, which fixes three security issues, several bugs, and adds various enhancements, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores,...

Apache ActiveMQ 5.x < 5.10.1 Multiple Vulnerabilities

Binary data 8961.prm...

Apache ActiveMQ File Upload Directory Traversal (CVE-2015-1830)

A directory traversal vulnerability exists in Apache ActiveMQ. The vulnerability is due to a flaw in the file server upload/download functionality used for blob messages. A remote, unauthenticated attacker may exploit this vulnerability by uploading a specially crafted file to the server...

Apache ActiveMQ RestFilter Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apache ActiveMQ. Authentication is not required to exploit this vulnerability. The specific flaw exists within ActiveMQ fileserver web application. By issuing specially crafted requests, an attacke...