CVE-2010-1587

The CVE-2010-1587 issue affects Apache ActiveMQ with the Jetty ResourceHandler. It enables a remote attacker to disclose JSP source code by sending a URI beginning with // that targets (admin/index.jsp, admin/queues.jsp, or admin/topics.jsp). Affected products/versions are ActiveMQ 5.x before 5.3...

CVE-2010-1587

The Jetty ResourceHandler in Apache ActiveMQ 5.x before 5.3.2 and 5.4.x before 5.4.0 allows remote attackers to read JSP source code via a // slash slash initial substring in a URI for 1 admin/index.jsp, 2 admin/queues.jsp, or 3 admin/topics.jsp...

Apache ActiveMQ 5.3 - adminqueueBrowse Cross-Site Scripting

Apache ActiveMQ 5.3 - adminqueueBrowse Cross-Site Scripting source: https://www.securityfocus.com/bid/39771/info Apache ActiveMQ is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary...

Apache ActiveMQ 5.3 - 'admin/queueBrowse' Cross-Site Scripting

source: https://www.securityfocus.com/bid/39771/info Apache ActiveMQ is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the conte...

Apache ActiveMQ is prone to source code disclosure vulnerability.

Apache ActiveMQ Source Code Disclosure Vulnerability SecPod Technologies www.secpod.com Author Veerendra G.G SecPod ID: 1002 04/18/2010 Issue Discovered 04/20/2010 Vendor Notified 04/21/2010 Fix Available Class: Source code disclosure Severity: Medium Overview: --------- Apache ActiveMQ is prone ...

Apache ActiveMQ URL请求源码泄露漏洞

BUGTRAQ ID: 39636 Apache ActiveMQ是流行的消息传输和集成模式提供程序。 Apache ActiveMQ中存在输入验证错误，用户在提交给admin/index.jsp、admin/queues.jsp、admin /topics.jsp等管理页面的URL请求后附加“//”就可以读取JSP页面源码。 0 Apache Group ActiveMQ 5.3.1 临时解决方法： 1. 到$ACTIVEMQHOME/webapps目录下 2. 创建名为static的新目录 - mkdir static 3. 将index.html文件移动到该目录下 - mv...

Apache ActiveMQ Double Slash Request Source Code Disclosure

The version of Apache ActiveMQ hosted on the remote web server is affected by a source code disclosure vulnerability in the Jetty ResourceHandler when handling requests to a JSP file with additional leading slashes. A remote attacker can exploit this to disclose the source code of pages, which ma...

Apache ActiveMQ Source Code Disclosure

Apache ActiveMQ Source Code Disclosure Vulnerability SecPod Technologies www.secpod.com Author Veerendra G.G SecPod ID: 1002 04/18/2010 Issue Discovered 04/20/2010 Vendor Notified 04/21/2010 Fix Available Class: Source code disclosure Severity: Medium Overview: --------- Apache ActiveMQ is prone ...

Apache ActiveMQ Source Code Information Disclosure Vulnerability

Apache ActiveMQ is prone to source code information disclosure vulnerability. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Apache ActiveMQ 5.25.3 - Source Code Information Disclosure

Apache ActiveMQ 5.25.3 - Source Code Information Disclosure source: https://www.securityfocus.com/bid/39636/info Apache ActiveMQ is prone to a vulnerability that lets attackers access source code because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability...

Apache ActiveMQ 5.2/5.3 - Source Code Information Disclosure

source: https://www.securityfocus.com/bid/39636/info Apache ActiveMQ is prone to a vulnerability that lets attackers access source code because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable computer in...

Apache ActiveMQ Detection

An administrative web interface for Apache ActiveMQ is running on the remote host. ActiveMQ is an open source messaging and Enterprise Integration Patterns server system. Note that starting with version 5.4.0, HTTP Basic Authentication is available to secure the administrative interface, and...

Apache ActiveMQ Web Console Test Pages Information Disclosure

The Apache ActiveMQ Web Console running on the remote host is leaking information via its test pages. The ActiveMQ Web Console allows unrestricted, unauthenticated access by default, and the test pages are used for testing the environment and web framework. One of the included test pages,...

CVE-2010-1244

Cross-site request forgery CSRF vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote attackers to hijack the authentication of unspecified victims for requests that create queues via the JMSDestination parameter in a queue action...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote attackers to hijack the authentication of unspecified victims for requests that create queues via the JMSDestination parameter in a queue action...

CVE-2010-0684

Cross-site scripting XSS vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote authenticated users to inject arbitrary web script or HTML via the JMSDestination parameter in a queue action...

Cross site scripting

Cross-site scripting XSS vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote authenticated users to inject arbitrary web script or HTML via the JMSDestination parameter in a queue action...

CVE-2010-1244

Cross-site request forgery CSRF vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote attackers to hijack the authentication of unspecified victims for requests that create queues via the JMSDestination parameter in a queue action...

CVE-2010-0684

Cross-site scripting XSS vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote authenticated users to inject arbitrary web script or HTML via the JMSDestination parameter in a queue action...

CVE-2010-1244

Apache ActiveMQ contains a CSRF vulnerability in createDestination.action that affects releases prior to 5.3.1. An attacker could remotely hijack an authenticated user’s session to create queues via the JMSDestination parameter in a queue action. The issue is documented across multiple sources ty...