Liferay Portal and Liferay DXP Cross-Site Scripting Vulnerability (CNVD-2021-62970)

Liferay Portal and Liferay DXP are both products of Liferay, a J2EE-based portal solution that uses EJB and JMS technologies and serves as a web publishing and shared workspace, enterprise collaboration platform, social network, etc. Liferay DXP is a digital experience collaboration platform...

Arbitrary Code Execution

rabbitmq-jms is vulnerable to arbitrary code execution. Untrusted objects are not filtered and passed through StreamMessage in the JMS to be deserialized before or while being given to the message listeners. An authenticated user is able to abuse the vulnerability to execute arbitrary code on the...

CVE-2020-36282

JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution via crafted StreamMessage data...

CVE-2020-36282

JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution via crafted StreamMessage data...

CVE-2020-36282

JMS Client for RabbitMQ (1.x <1.15.2 and 2.x

CVE-2020-36282

JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution via crafted StreamMessage data...

Important: Red Hat Security Advisory: Red Hat build of Thorntail 2.7.3 security and bug fix update

An update is now available for Red Hat build of Thorntail. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more...

wildfly: resource adapter logs plaintext JMS password at warning level on connection error

A flaw was found in wildfly. JMS passwords are logged by the resource adaptor in plain text at the warning level when a connection error occurs allowing any user that has access to the log to gain access to this sensitive information. The highest threat from this vulnerability is to data...

Security Bulletin: App Connect Enterprise Certified Container may be vulnerable to a remote code execution vulnerability (CVE-2020-4682)

Summary An issue was found within the IBM MQ Java and JMS client libraries that could allow an attacker to execute a remote code execution attack through the IBM MQ Java and JMS client libraries in an Integration Server image. Vulnerability Details CVEID: CVE-2020-4682 DESCRIPTION: IBM MQ 7.5, 8....

Security Bulletin: IBM MQ is vulnerable to a remote code execution vulnerability (CVE-2020-4682)

Summary An issue was found within the IBM MQ Java and JMS client libraries that could allow an attacker to execute a remote code execution attack. Vulnerability Details CVEID: CVE-2020-4682 DESCRIPTION: IBM MQ could allow a remote attacker to execute arbitrary code on the system, caused by an...

CVE-2020-25640

A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection error, inserting sensitive information in the log file...

CVE-2020-25640

A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection error, inserting sensitive information in the log file...

Design/Logic Flaw

A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection error, inserting sensitive information in the log file...

CVE-2020-25640

A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection error, inserting sensitive information in the log file...

@attraqt/activity (>=0.0.1 <=1.3.0-alpha.3), @attraqt/xo-js (=0.0.1) +2 more potentially affected by CVE-2020-28464 via djv (=2.1.3-alpha.0)

djv NPM version =2.1.3-alpha.0 is affected by a known vulnerability. The following packages have a transitive dependency on djv and may be impacted: - @attraqt/activity =0.0.1, =1.1.8, =1.0.3, =1.1.6 Source cves: CVE-2020-28464 Source advisory: SNYK:JS-DJV-1014545...

CVE-2020-25640

A flaw was found in wildfly. JMS passwords are logged by the resource adaptor in plain text at the warning level when a connection error occurs allowing any user that has access to the log to gain access to this sensitive information. The highest threat from this vulnerability is to data...

Security Bulletin: CVE-2015-5254 Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker

Summary CVE-2015-5254 Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service JMS ObjectMessage object. Vulnerability Details CVEID: CVE-2015-5254...

jackson-databind: improper polymorphic deserialization in axis2-transport-jms class

A flaw was discovered in jackson-databind, where it would permit polymorphic deserialization of a malicious object using the axis2-transport-jms class. An attacker could use this flaw to execute arbitrary code...

CVE-2020-14061

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and...

UBUNTU-CVE-2020-14061

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and...