ActiveMQ_CVE-2015-5254

إلغاء تسلسل ActiveMQ CVE-2015-5254 وصف الثغرة: توجد ثغرة أمنية في الإصدارات 5.x من Apache ActiveMQ قبل الإصدار 5.13.0، وتنبع هذه الثغرة من عدم قيام البرنامج بتقييد الفئات التي يمكن تسلسلها في الوسيط broker. يمكن للمهاجم عن بُعد استغلال هذه الثغرة لتنفيذ تعليمات برمجية عشوائية باستخدام كائنات Java...

Exploitation-de-la-vuln-rabilit-CVE-2015-5254-

استغلال الثغرة الأمنية CVE-2015-5254- الثغرة الأمنية CVE-2015-5254 هي عيب أمني في Apache ActiveMQ، وهو خادم رسائل مفتوح المصدر يُستخدم على نطاق واسع للاتصال بين التطبيقات. تؤثر هذه الثغرة على إصدارات ActiveMQ حتى الإصدار 5.13.0 وتكمن في نقص التصفية على بيانات الإدخال JMS ObjectMessage المرسلة. مس...

Deserialization Of Untrusted Data

Apache CXF is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to native Java deserialization of inbound JMS ObjectMessage objects without type restrictions, which allows an attacker who can place messages on the JMS destination to submit malicious serialized objects that...

Deserialization Of Untrusted Data

Apache Camel is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to improper deserialization of a crafted JMS ObjectMessage containing an allowed DefaultExchangeHolder object, which bypasses the CVE-2026-40860 class check and allows an attacker who can publish messages to...

Apache camel-jms, camel-sjms, camel-sjms2 and camel-amqp: Unsafe Deserialization of JMS ObjectMessage

JmsBinding.extractBodyFromJms in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject without applying any ObjectInputFilter, class allowlist or class denylist. Because this code path is...

GHSA-M5VH-3FW5-5WGH Apache camel-jms, camel-sjms, camel-sjms2 and camel-amqp: Unsafe Deserialization of JMS ObjectMessage

JmsBinding.extractBodyFromJms in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject without applying any ObjectInputFilter, class allowlist or class denylist. Because this code path is...

CVE-2026-40860

Apache Camel is vulnerable to remote code execution (RCE) due to unsafe deserialization in the camel-jms component and related JMS-family components (including camel-sjms , camel-sjms2 , camel-amqp , camel-activemq , and camel-activemq6 ). The root cause is that JmsBinding.extractBodyFromJms() de...

EUVD-2021-7743

Malicious code in bioql PyPI...

CVE-2021-20318

The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage...

Hardcoded credentials

The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage...

CVE-2021-20318

The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage...

CVE-2021-20318: Deserialization of Untrusted Data

The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage...

PT-2021-13883

Name of the Vulnerable Software and Affected Versions: Artemis in EAP 7 affected versions not specified Description: A flaw in the HornetQ component of Artemis in EAP 7 allows a remote attacker to execute arbitrary code with the permissions of the application using a JMS ObjectMessage...

CVE-2021-20318

The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage...

Red Hat Jboss Enterprise Application Platform 7 代码问题漏洞

Red Hat Jboss Enterprise Application Platform 7 Red Hat Jboss Eap 7 is a middleware platform built on open standards and compatible with the Java Ee 7 specification from Red Hat USA. A code issue vulnerability exists in Red Hat JBoss Enterprise Application Platform 7 Artemis that stems from the...

Security Bulletin: CVE-2015-5254 Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker

Summary CVE-2015-5254 Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service JMS ObjectMessage object. Vulnerability Details CVEID: CVE-2015-5254...

Security Bulletin: Vulnerability in Apache ActiveMQ affects IBM Control Center (CVE-2015-5254)

Summary An Apache ActiveMQ vulnerability for potentially allowing a remote attacker to execute arbitrary code was addressed by IBM Control Center. Control Center is only vulnerable if configured to use JMS Java Messaging Service. Vulnerability Details CVEID: CVE-2015-5254 DESCRIPTION: Apache...

CVE-2016-0276

IBM Financial Transaction Manager FTM for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, Financial Transaction Manager FTM for Check Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, and Financial Transaction Manager FTM for Corporate Payment Services CPS for...

CVE-2016-0276: Improper Input Validation

IBM Financial Transaction Manager FTM for ACH Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, Financial Transaction Manager FTM for Check Services for Multi-Platform 2.1.1.2 and 3.0.0.x before fp0013, and Financial Transaction Manager FTM for Corporate Payment Services CPS for...

PT-2018-4599

Name of the Vulnerable Software and Affected Versions Financial Transaction Manager FTM for ACH Services for Multi-Platform versions 2.1.1.2 through 3.0.0.x before fp0013 Financial Transaction Manager FTM for Check Services for Multi-Platform versions 2.1.1.2 through 3.0.0.x before fp0013 Financi...