activemq-cve-lab

ActiveMQ Message Broker Overview ActiveMQ message broker application with message import/export functionality. Version: 5.11.1 Features Message queue management Queue statistics and monitoring Message file import/export Real-time broker status Quick Start Docker docker-compose up -d Access:...

apache__activemq_CVE-2014-3576_5-10-1

Welcome to Apache ActiveMQ Apache ActiveMQ is a high performance Apache 2.0 licensed Message Broker and JMS 1.1 implementation. Getting Started To help you get started, try the following links: Getting Started http://activemq.apache.org/version-5-getting-started.html Building...

apache__activemq_CVE-2019-0222_5-15-8

Welcome to Apache ActiveMQ Apache ActiveMQ is a high performance Apache 2.0 licensed Message Broker and JMS 1.1 implementation. Getting Started To help you get started, try the following links: Getting Started http://activemq.apache.org/version-5-getting-started.html Building...

EUVD-2026-91830

Armatura One's message broker logs client connection credentials and the associated password in plain text during normal operation. Any party with read access to this log, or to a backup or support bundle that includes it, can obtain the logged credential...

CVE-2026-94594

Armatura One's message broker logs client connection credentials and the associated password in plain text during normal operation. Any party with read access to this log, or to a backup or support bundle that includes it, can obtain the logged credential...

CVE-2026-94594 Armatura LLC Armatura One Insertion of Sensitive Information into Log File

Armatura One's message broker logs client connection credentials and the associated password in plain text during normal operation. Any party with read access to this log, or to a backup or support bundle that includes it, can obtain the logged credential...

CVE-2026-94594

The Armatura One message broker is vulnerable to CWE-532 because it logs client connection credentials and associated passwords in plain text during normal operation. Any individual or entity with read access to the application logs, or to associated backups and support bundles containing these l...

CVE-2026-94594 Armatura LLC Armatura One Insertion of Sensitive Information into Log File

Armatura One's message broker logs client connection credentials and the associated password in plain text during normal operation. Any party with read access to this log, or to a backup or support bundle that includes it, can obtain the logged credential...

OpenWire-CVE-2023-46604-Investigation

OpenWire-CVE-2023-46604-Investigation OpenWire Lab During my shift as a Tier 2 Security Operations Center SOC Analyst, I received an escalation from a Tier 1 analyst regarding a publicly accessible server that had been observed communicating with multiple suspicious external IP addresses. In...

CVE-2026-94594: Insertion of Sensitive Information into Log File

Armatura One's message broker logs client connection credentials and the associated password in plain text during normal operation. Any party with read access to this log, or to a backup or support bundle that includes it, can obtain the logged credential...

PT-2026-104439

Name of the Vulnerable Software and Affected Versions Armatura One affected versions not specified Description The message broker logs client connection credentials and the associated password in plain text during normal operation. This allows any party with read access to the log files, backups,...

GO-2026-6523 Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials in github.com/frain-dev/convoy

Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials in github.com/frain-dev/convoy...

Astra Linux – Vulnerability in rabbitMQ-server

RabbitMQ is a multi-protocol messaging and streaming broker. The HTTP API does not enforce a limit on the size of HTTP request bodies, making it vulnerable to Denial of Service DoS attacks involving very large messages. A verified user with sufficient credentials can publish very large messages...

UBUNTU-CVE-2026-61634

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, the AMQP connection tuning path records the negotiated AMQP framemax value, but src/main/java/com/rabbitmq/client/impl/SocketFrameHandler.java and...

CVE-2026-71274

OpenBK7231T's CHANNELSetLabel src/cmnds/cmdchannels.c stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitization. CHANNELGetLabel returns these labels unsanitized, and they are rendered via hprintf255 at 15+ locations in src/httpserver/httpfns.c wit...

CVE-2026-71279 Zigbee2MQTT External JS Extension Path Traversal Leading to Remote Code Execution

Zigbee2MQTT's ExternalJSExtension.getFilePath lib/extension/externalJS.ts joins a parameter received via an MQTT message topic zigbee2mqtt/bridge/request/extension/save into the extensions base path using path.joinbasePath, name with no sanitization. The extension handler only validates that the...

EUVD-2026-53364

Zigbee2MQTT's ExternalJSExtension.getFilePath lib/extension/externalJS.ts joins a name parameter received via an MQTT message topic zigbee2mqtt/bridge/request/extension/save into the extensions base path using path.joinbasePath, name with no sanitization. Because path.join resolves ../ sequences,...

CVE-2026-44091

CVE-2026-44091 describes an unauthenticated remote attacker who can post a malicious ID to the MQTT Broker, causing the creation of a new configuration entry in the system configuration. This may lead to integrity and availability loss. The published CVSS metrics indicate a high severity: CVSS 4....

EUVD-2026-51026

An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configuration entry in the system configuration. This may lead to integrity and availability loss...

CVE-2026-44090 Missing authentication for MQTT Broker

Due to missing authentication, an unauthenticated remote attacker may access the MQTT broker, which is only protected from external access by a firewall. This may lead to the device being fully compromised...