Apache ActiveMQ Web Console Cross-Site Scripting Vulnerability

Apache ActiveMQ is a popular messaging and integration model provider . Apache ActiveMQ 5.0.0 - 5.13.1 Multiple cross-site scripting vulnerabilities exist in the Web Management Console and in Java memory dumps due to incorrect user data output validation and improper privilege settings within...

Apache ActiveMQ 5.x < 5.11.2 Blob Message Directory Traversal

Binary data 9079.prm...

Apache ActiveMQ 5.x < 5.13.0 Java Object Unserialization RCE

Binary data 9080.prm...

CVE-2015-5254

Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service JMS ObjectMessage object...

CVE-2015-5254

Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service JMS ObjectMessage object...

Code injection

Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service JMS ObjectMessage object...

CVE-2015-5254

CVE-2015-5254 is a deserialization vulnerability in Apache ActiveMQ 5.x prior to 5.13.0. The broker does not restrict serialized classes, enabling remote attackers to execute arbitrary code via a crafted JMS ObjectMessage. Several connected advisories confirm the issue and note mitigations: upgra...

CVE-2015-5254

Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service JMS ObjectMessage object...

CVE-2015-5254

Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service JMS ObjectMessage object...

CVE-2015-5254: Improper Input Validation

Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service JMS ObjectMessage object...

Apache ActiveMQ 5.x < 5.13.0 Java Object Deserialization RCE

The version of Apache ActiveMQ running on the remote host is 5.x prior to 5.13.0. It is, therefore, affected by a remote code execution vulnerability in the broker due to unsafe deserialize calls of unauthenticated Java objects to the Apache Commons Collections ACC library. An unauthenticated,...

Apache ActiveMQ Arbitrary File Write

The vulnerability of the load/data retrieval functions of the Apache ActiveMQ software platform exists due to an incorrect path limitation for the directory with restricted access. Exploiting this vulnerability allows a malicious actor to create JSP files in arbitrary directories remotely...

Apache ActiveMQ Auth Bypass

The vulnerability of the LDAPLoginModule implementation and the Java Authentication and Authorization Service components of the Apache ActiveMQ software platform is related to errors in managing registration data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to...

Important: Red Hat Security Advisory: Red Hat JBoss A-MQ 6.2.1 update

Red Hat JBoss A-MQ 6.2.1, which fixes three security issues, several bugs, and adds various enhancements, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores,...

Apache ActiveMQ 5.x < 5.10.1 Multiple Vulnerabilities

Binary data 8961.prm...

Apache ActiveMQ File Upload Directory Traversal (CVE-2015-1830)

A directory traversal vulnerability exists in Apache ActiveMQ. The vulnerability is due to a flaw in the file server upload/download functionality used for blob messages. A remote, unauthenticated attacker may exploit this vulnerability by uploading a specially crafted file to the server...

Apache ActiveMQ RestFilter Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apache ActiveMQ. Authentication is not required to exploit this vulnerability. The specific flaw exists within ActiveMQ fileserver web application. By issuing specially crafted requests, an attacke...

CVE-2015-6524

The LDAPLoginModule implementation in the Java Authentication and Authorization Service JAAS in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack. NOTE: this identifier was SPLIT from CVE-2014-361...

DEBIAN-CVE-2015-6524

The LDAPLoginModule implementation in the Java Authentication and Authorization Service JAAS in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack. NOTE: this identifier was SPLIT from CVE-2014-361...

CVE-2015-6524

The LDAPLoginModule implementation in the Java Authentication and Authorization Service JAAS in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack. NOTE: this identifier was SPLIT from CVE-2014-361...