activemq-cve-lab

ActiveMQ Message Broker Resumen Aplicación de broker de mensajes ActiveMQ con funcionalidad de importación/exportación de mensajes. Versión: 5.11.1 Características Gestión de colas de mensajes Estadísticas y monitoreo de colas Importación/exportación de archivos de mensajes Estado del broker en...

apache__activemq_CVE-2014-3576_5-10-1

Bienvenido a Apache ActiveMQ Apache ActiveMQ es un Message Broker de alto rendimiento bajo licencia Apache 2.0 e implementación de JMS 1.1. Primeros pasos Para ayudarte a comenzar, prueba los siguientes enlaces: Primeros pasos http://activemq.apache.org/version-5-getting-started.html Compilación...

apache__activemq_CVE-2019-0222_5-15-8

Welcome to Apache ActiveMQ Apache ActiveMQ is a high performance Apache 2.0 licensed Message Broker and JMS 1.1 implementation. Getting Started To help you get started, try the following links: Getting Started http://activemq.apache.org/version-5-getting-started.html Building...

OpenWire-CVE-2023-46604-Investigation

Investigación de OpenWire-CVE-2023-46604 Laboratorio OpenWire Durante mi turno como Analista de Centro de Operaciones de Seguridad SOC de Nivel 2, recibí una escalación de un analista de Nivel 1 sobre un servidor de acceso público que había sido observado comunicándose con múltiples direcciones I...

Astra Linux – Vulnerability in rabbitMQ-server

RabbitMQ is a multi-protocol messaging and streaming broker. The HTTP API does not enforce a limit on the size of HTTP request bodies, making it vulnerable to Denial of Service DoS attacks involving very large messages. A verified user with sufficient credentials can publish very large messages...

UBUNTU-CVE-2026-61634

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, the AMQP connection tuning path records the negotiated AMQP framemax value, but src/main/java/com/rabbitmq/client/impl/SocketFrameHandler.java and...

CVE-2026-71274

OpenBK7231T's CHANNELSetLabel src/cmnds/cmdchannels.c stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitization. CHANNELGetLabel returns these labels unsanitized, and they are rendered via hprintf255 at 15+ locations in src/httpserver/httpfns.c wit...

CVE-2026-71279 Zigbee2MQTT External JS Extension Path Traversal Leading to Remote Code Execution

Zigbee2MQTT's ExternalJSExtension.getFilePath lib/extension/externalJS.ts joins a parameter received via an MQTT message topic zigbee2mqtt/bridge/request/extension/save into the extensions base path using path.joinbasePath, name with no sanitization. The extension handler only validates that the...

EUVD-2026-53364

Zigbee2MQTT's ExternalJSExtension.getFilePath lib/extension/externalJS.ts joins a name parameter received via an MQTT message topic zigbee2mqtt/bridge/request/extension/save into the extensions base path using path.joinbasePath, name with no sanitization. Because path.join resolves ../ sequences,...

EUVD-2026-51026

An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configuration entry in the system configuration. This may lead to integrity and availability loss...

CVE-2026-44091

CVE-2026-44091 describes an unauthenticated remote attacker who can post a malicious ID to the MQTT Broker, causing the creation of a new configuration entry in the system configuration. This may lead to integrity and availability loss. The published CVSS metrics indicate a high severity: CVSS 4....

CVE-2026-44090 Missing authentication for MQTT Broker

Due to missing authentication, an unauthenticated remote attacker may access the MQTT broker, which is only protected from external access by a firewall. This may lead to the device being fully compromised...

EUVD-2026-51025

Due to missing authentication, an unauthenticated remote attacker may access the MQTT broker, which is only protected from external access by a firewall. This may lead to the device being fully compromised...

Improper Authorization

Overview org.apache.activemq:activemq-amqp is a high performance Apache 2.0 licensed Message Broker and JMS 1.1 implementation. Affected versions of this package are vulnerable to Improper Authorization in AuthorizationBroker through the temporary-destination write ACL check in...

ROS-20260727-73-0012

A vulnerability in the message broker administration console of the Apache ActiveMQ software platform is related to flaws in the code generation control mechanism. Exploitation of this vulnerability could allow a remote attacker to execute arbitrary code...

PT-2026-59271

Node names long name, short name received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping. Any participant on a public Meshtastic MQTT broker can set a malicious node name that executes JavaScript in the browser of every Malla dashboard visitor...

Spring Office Hours Podcast: S5E17 - Spring Boot 4.1 with Phil Webb

Join Dan Vega and DaShaun Carter for the latest updates from the Spring Ecosystem. In this episode, Dan and DaShaun are joined by Spring Boot co-creator and project lead Phil Webb to dig into what's new in Spring Boot 4.1. They walk through the headline features landing in this release, including...

CVE-2026-50085

The Aqara Board service op-test.aqara.com accepts arbitrary MQTT command payloads, and forwards them to the platfom's HiveMQ broker without authentication. This is an instance of "CWE-306: Missing Authentication for Critical Function" and has an estimated CVSS...

CVE-2026-10557

CVE-2026-10557 concerns the Yarbo Android/iOS mobile applications, where hard-coded MQTT broker credentials are embedded in the application binary and identical across all users/devices. These credentials are extractable via APK decompilation and provide access to cloud MQTT brokers carrying real...

CVE-2026-46411

FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.26.2, authorized clients have the ability to exceed the permitted over-commit of their write buffer and triggering an internal safe-guard exception. This exception was in a path that was not catchable, and...