CVE-2020-10727: Cleartext Storage of Sensitive Information

A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis shadow file etc/artemis-users.properties file when executing the resetUsers operation. A local attacker can use this flaw to read the...

Important: Red Hat Security Advisory: Red Hat AMQ Broker 7.7 release and security update

Red Hat AMQ Broker 7.7 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

broker: resetUsers operation stores password in plain text

A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis shadow file etc/artemis-users.properties file when executing the resetUsers operation. A local attacker can use this flaw to read the...

CVE-2020-10727

A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis shadow file etc/artemis-users.properties file when executing the resetUsers operation. A local attacker can use this flaw to read the...

PT-2020-3006

Name of the Vulnerable Software and Affected Versions ActiveMQ Artemis versions 2.7.0 through 2.12.0 Description A flaw in the ActiveMQ Artemis management API allows a user to inadvertently store passwords in plaintext in the Artemis shadow file etc/artemis-users.properties file when executing th...

artemis/hornetq: memory exhaustion via UDP and JGroups discovery

It was found that when Artemis and HornetQ are configured with UDP discovery and JGroups discovery a huge byte array is created when receiving an unexpected multicast message. This may result in a heap memory exhaustion, full GC, or OutOfMemoryError...

Critical: Red Hat Security Advisory: EAP Continuous Delivery Technical Preview Release 12 security update

This is a security update for JBoss EAP Continuous Delivery 12.0. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

Important: Red Hat Security Advisory: Red Hat AMQ Broker 7.4.3 release and security update

Red Hat AMQ Broker 7.4.3 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

Important: Red Hat Security Advisory: Red Hat AMQ Broker 7.6 release and security update

Red Hat AMQ Broker 7.6 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

Important: Red Hat Security Advisory: Red Hat A-MQ Broker 7.5 release and security update

Red Hat A-MQ Broker 7.5 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

artemis-online.org.uk Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-902490 Security Researcher bill Helped patch 52 vulnerabilities Received 2 Coordinated Disclosure badges Received 2 recommendations , a holder of 2 badges for responsible and coordinated disclosure, found a security vulnerability affecting artemis-online.org.uk website and...

Design/Logic Flaw

In Eclipse Kura versions up to 4.0.0, the Web UI package and component services, the Artemis simple Mqtt component and the emulator position service not part of the device distribution could potentially be target of XXE attack due to an improper factory and parser initialisation...

CVE-2019-10244

In Eclipse Kura versions up to 4.0.0, the Web UI package and component services, the Artemis simple Mqtt component and the emulator position service not part of the device distribution could potentially be target of XXE attack due to an improper factory and parser initialisation...

CVE-2019-10244

CVE-2019-10244 affects Eclipse Kura up to version 4.0.0. The vulnerability points to XXE attacks via the Web UI package and component services, the Artemis simple MQTT component, and the emulator position service (not part of the device distribution) caused by improper factory and parser initiali...

CVE-2019-10244: Improper Restriction of XML External Entity Reference

In Eclipse Kura versions up to 4.0.0, the Web UI package and component services, the Artemis simple Mqtt component and the emulator position service not part of the device distribution could potentially be target of XXE attack due to an improper factory and parser initialisation...

PT-2019-11655

Name of the Vulnerable Software and Affected Versions: Eclipse Kura versions up to 4.0.0 Description: The issue is related to an improper factory and parser initialization, which could make certain components targets of an XXE attack. The affected components include the Web UI package and compone...

Denial Of Service (DoS)

artemis-server is vulnerable to denial of service DoS through memory leaks. Writing a large paged message is not properly handled which causes a wrong way of subtraction of paging store size and global size, resulting in a disclosure of address size...

Remote Code Execution Through Deserialization Attack

Apache ActiveMQ Artemis is vulnerable to deserialization attacks. The JMS specification outlines a getObject method on the javax.jms.ObjectMessage class. The Apache Artemis implementation of this method allows the deserialization of objects, from untrusted sources. There are several places where...

artemis-kautschuk.de XSS vulnerability

Open Bug Bounty ID: OBB-710277 Description| Value ---|--- Affected Website:| artemis-kautschuk.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| hidden until disclosure Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:|...

artemis.havas.com XSS vulnerability

Open Bug Bounty ID: OBB-630870 Description| Value ---|--- Affected Website:| artemis.havas.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...