artemis2hashcat

artemis2hashcat Description Python3 implementation for converting Artemis PBKDF2WithHmacSHA1 hashes to hashcat format Usage The default configuration for Apache Artemis is to use the DefaultSensitiveStringCodec in order to store user passwords as PBKDF2WithHmacSHA1 hashes in the...

Apache Artemis Authentication Bypass

The vulnerability of asynchronous messaging systems like Apache ActiveMQ and Apache Artemis lies in the lack of authentication for critical functions. Exploiting this vulnerability can allow a malicious actor to gain full control over the application...

Exploit for Missing Authentication for Critical Function in Apache Artemis

CVE-2026-57967 — Apache ActiveMQ Artemis Unauthenticated Sessi...

com.aspectran:aspectow-appmon-demo (3.2.0), com.aspectran:aspectran-all (>=9.4.3, <=9.6.2) +31 more potentially affected by CVE-2026-77421 via org.jline:jline-builtins (>=4.0.0, <=4.3.0)

org.jline:jline-builtins MAVEN version =4.0.0, =9.4.3, =9.4.3, =9.4.3, =2.54.0, =2.54.0, =2.54.0, =2.54.0, =2.54.0, =2.54.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.21.0 and more Source cves: CVE-2026-77421 Source advisory: SNYK:JAVA-ORGJLINE-20078913...

com.aspectran:aspectow-appmon-demo (3.2.0), com.aspectran:aspectran-all (>=9.4.3, <=9.6.2) +31 more potentially affected by CVE-2026-77421 via org.jline:jline-builtins (>=4.0.0, <=4.3.0)

org.jline:jline-builtins MAVEN version =4.0.0, =9.4.3, =9.4.3, =9.4.3, =2.54.0, =2.54.0, =2.54.0, =2.54.0, =2.54.0, =2.54.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.21.0 and more Source cves: CVE-2026-77421 Source advisory: GHSA-PH9C-7HW9-VHHW...

com.aspectran:aspectow-appmon-demo (3.2.0), com.aspectran:aspectran-all (>=9.4.3, <=9.6.2) +31 more potentially affected by CVE-2026-77422 via org.jline:jline-builtins (>=4.0.0, <=4.3.0)

org.jline:jline-builtins MAVEN version =4.0.0, =9.4.3, =9.4.3, =9.4.3, =2.54.0, =2.54.0, =2.54.0, =2.54.0, =2.54.0, =2.54.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.21.0 and more Source cves: CVE-2026-77422 Source advisory: GHSA-R2XF-8XR9-62GW...

com.aspectran:aspectow-appmon-demo (3.2.0), com.aspectran:aspectran-all (>=9.4.3, <=9.6.2) +31 more potentially affected by CVE-2026-77422 via org.jline:jline-builtins (>=4.0.0, <=4.3.0)

org.jline:jline-builtins MAVEN version =4.0.0, =9.4.3, =9.4.3, =9.4.3, =2.54.0, =2.54.0, =2.54.0, =2.54.0, =2.54.0, =2.54.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.21.0 and more Source cves: CVE-2026-77422 Source advisory: SNYK:JAVA-ORGJLINE-20079221...

artemis-server: Apache Artemis — session hijack via missing authentication

in Apache Artemis, the REATTACHSESSION handler performs zero authentication — it looks up the session by name only and calls transferConnection unconditionally, migrating the authenticated session to the attacker's connection. The hijacked cluster-bridge session inherits full broker-management...

artemis-server: Apache Artemis — session hijack via missing authentication

in Apache Artemis, the REATTACHSESSION handler performs zero authentication — it looks up the session by name only and calls transferConnection unconditionally, migrating the authenticated session to the attacker's connection. The hijacked cluster-bridge session inherits full broker-management...

artemis-server: Apache Artemis — session hijack via missing authentication

in Apache Artemis, the REATTACHSESSION handler performs zero authentication — it looks up the session by name only and calls transferConnection unconditionally, migrating the authenticated session to the attacker's connection. The hijacked cluster-bridge session inherits full broker-management...

artemis-server: Apache Artemis — session hijack via missing authentication

in Apache Artemis, the REATTACHSESSION handler performs zero authentication — it looks up the session by name only and calls transferConnection unconditionally, migrating the authenticated session to the attacker's connection. The hijacked cluster-bridge session inherits full broker-management...

artemis-server: Apache Artemis — session hijack via missing authentication

in Apache Artemis, the REATTACHSESSION handler performs zero authentication — it looks up the session by name only and calls transferConnection unconditionally, migrating the authenticated session to the attacker's connection. The hijacked cluster-bridge session inherits full broker-management...

RHEL 7 / 8 / 9 : Red Hat JBoss Enterprise Application Platform 7.4.25 (RHSA-2026:67604)

The remote Redhat Enterprise Linux 7 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67604 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This...

Apache Artemis 1.0.0 < 2.45.0 / 2.50.0 < 2.57.0 Multiple Vulnerabilities

The version of Apache Artemis formerly Apache ActiveMQ Artemis installed on the remote host is affected by multiple vulnerabilities: - An unauthenticated remote attacker can craft a CORE protocol SESSIONREATTACH packet to steal an existing session and assume ongoing execution of the previously...

Apache Artemis 1.3.0 < 2.45.0 / 2.50.0 < 2.57.0 Denial of Service (CVE-2026-57822)

The version of Apache Artemis formerly Apache ActiveMQ Artemis installed on the remote host is affected by a vulnerability: - When the broker is processing message-based management requests, sent by an authenticated messaging client that is authorized with MANAGE permission to perform...

artemis-server: Apache Artemis — session hijack via missing authentication

in Apache Artemis, the REATTACHSESSION handler performs zero authentication — it looks up the session by name only and calls transferConnection unconditionally, migrating the authenticated session to the attacker's connection. The hijacked cluster-bridge session inherits full broker-management...

artemis-openwire-protocol: AMQ Broker Artemis: pre-authentication arbitrary durable queue deletion via OpenWire RemoveSubscriptionInfo

An unauthenticated network attacker can delete arbitrary durable queues on any Apache Artemis broker with OpenWire protocol enabled default. The processRemoveSubscription method executes pre-authentication with no authorization check, and uses the internal destroyQueueSimpleString overload that...

artemis-server: Apache Artemis — session hijack via missing authentication

in Apache Artemis, the REATTACHSESSION handler performs zero authentication — it looks up the session by name only and calls transferConnection unconditionally, migrating the authenticated session to the attacker's connection. The hijacked cluster-bridge session inherits full broker-management...

artemis-openwire-protocol: AMQ Broker Artemis: pre-authentication arbitrary durable queue deletion via OpenWire RemoveSubscriptionInfo

An unauthenticated network attacker can delete arbitrary durable queues on any Apache Artemis broker with OpenWire protocol enabled default. The processRemoveSubscription method executes pre-authentication with no authorization check, and uses the internal destroyQueueSimpleString overload that...

CVE-2026-57967

in Apache Artemis, the REATTACHSESSION handler performs zero authentication — it looks up the session by name only and calls transferConnection unconditionally, migrating the authenticated session to the attacker's connection. The hijacked cluster-bridge session inherits full broker-management...