848 matches found
PT-2020-13781 · Apache +2 · Apache Activemq +2
Name of the Vulnerable Software and Affected Versions: Apache ActiveMQ versions prior to 5.15.12 Description: The issue allows an attacker to connect to the JMX RMI registry without authentication and rebind the jmxrmi entry. By creating a proxy server, an attacker can intercept user credentials...
CVE-2020-13920
CVE-2020-13920 affects Apache ActiveMQ through a JMX RMI registry authentication flaw. An unauthenticated client can bind a proxy to the jmxrmi entry, enabling MITM-style interception of credentials when users connect. Affected guidance: upgrade to a fixed ActiveMQ release (initial advisory cites...
CVE-2020-13920
Apache ActiveMQ uses LocateRegistry.createRegistry to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates another server to...
CVE-2020-13920
Apache ActiveMQ uses LocateRegistry.createRegistry to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates another server to...
Security Bulletin: IBM Resilient SOAR is Using Components with Known Vulnerabilities - activemq-camel-5.15.9.jar (CVE-2015-5182, CVE-2015-5183, CVE-2015-5184, CVE-2020-1941)
Summary activemq-camel-5.15.9.jar vulnerable to multiple CVEs. Details below. Vulnerability Details CVEID: CVE-2015-5182 DESCRIPTION: Red Hat JBoss A-MQ is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input by the jolokia API. By persuading an...
Security Bulletin: CVE-2015-5254 Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker
Summary CVE-2015-5254 Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service JMS ObjectMessage object. Vulnerability Details CVEID: CVE-2015-5254...
The vulnerability in the web console of the Apache ActiveMQ software platform allows a perpetrator to carry out cross-site scripting attacks.
The vulnerability of the Apache ActiveMQ software platform’s web administration consoles is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...
Security Bulletin: Vulnerability in Apache ActiveMQ affects IBM Control Center (CVE-2018-11775)
Summary Apache ActiveMQ Client could allow a remote attacker to conduct a man-in-the-middle attack, caused by a missing TLS hostname verification. An attacker could exploit this vulnerability to launch a man-in-the-middle attack between a Java application using the ActiveMQ client and the ActiveM...
Security Bulletin: Multiple Vulnerabilities affect IBM Sterling Secure Proxy
Summary Three Jetty request smuggling vulnerabilities and an Apache ActiveMQ man-in-the-middle vulnerability were addressed by IBM Sterling Secure Proxy. Vulnerability Details CVE-ID: CVE-2017-7656 Description: Eclipse Jetty is vulnerable to HTTP request smuggling, caused by a flaw in the HTTP/1....
CVE-2020-13932
In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console's browser. The XSS payload is triggered in the diagram plugin; queue node and th...
CVE-2020-13932
In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console's browser. The XSS payload is triggered in the diagram plugin; queue node and th...
Cross site scripting
In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console's browser. The XSS payload is triggered in the diagram plugin; queue node and th...
CVE-2020-13932
In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console's browser. The XSS payload is triggered in the diagram plugin; queue node and th...
Apache ActiveMQ 5.x < 5.15.12 XSS (CVE-2020-1941)
The version of Apache ActiveMQ running on the remote host is 5.x prior to 5.15.12. It is, therefore, affected by a cross-site scripting XSS vulnerability in the webconsole admin GUI. An unauthenticated, remote attacker can exploit this issue, by convincing a user to click a specially crafted URL,...
The vulnerability of the etc/artemis-users.properties component of the asynchronous messaging system Apache ActiveMQ Artemis is related to insufficient protection of registration data, allowing attackers to gain unauthorized access to protected information.
The vulnerability of the etc/artemis-users.properties component in the asynchronous message exchange system using Apache ActiveMQ Artemis is related to insufficient protection of registration data. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected...
Apache ActiveMQ webconsole admin GUI is open to XSS
In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue...
The vulnerability of the MQTT protocol implementation on the Apache ActiveMQ software platform allows a intruder to trigger a service failure.
The vulnerability of the MQTT protocol implementation on the Apache ActiveMQ software platform is related to improper code generation. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...
CVE-2020-1941
In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue...