CVE-2016-0782

CVE-2016-0782: Apache ActiveMQ 5.x prior to 5.11.4, 5.12.x prior to 5.12.3, and 5.13.x prior to 5.13.2 is vulnerable to cross-site scripting via the web admin console. The defect is improper validation of user-supplied input in the Admin Web console, enabling remote authenticated users to execute...

CVE-2016-6810

CVE-2016-6810 affects Apache ActiveMQ 5.x prior to 5.14.2, where the web-based administration console is vulnerable to cross-site scripting due to improper user data output validation. The issue could allow a remote attacker to execute script in a victim’s browser via the admin console URL. Remed...

CVE-2014-8110

Apache ActiveMQ (5.x) prior to 5.10.1 is affected by cross-site scripting in the web-based admin console (CVE-2014-8110). Attacks could inject script/HTML via unspecified vectors and, per related IBM advisories, could lead to credential theft via cookies. Remote exploitation is possible if expose...

CVE-2012-6551

CVE-2012-6551 affects Apache ActiveMQ: the default configuration enables a sample web application, allowing remote attackers to cause broker resource exhaustion (DoS) via HTTP requests. Affected version: ActiveMQ before 5.8.0. Impact is denial of service to the broker; no exploitation details are...

CVE-2010-1587

The CVE-2010-1587 issue affects Apache ActiveMQ with the Jetty ResourceHandler. It enables a remote attacker to disclose JSP source code by sending a URI beginning with // that targets (admin/index.jsp, admin/queues.jsp, or admin/topics.jsp). Affected products/versions are ActiveMQ 5.x before 5.3...

CVE-2013-1880

CVE-2013-1880 (ActiveMQ) : XSS in the Portfolio publisher servlet of the Apache ActiveMQ demo web app prior to 5.9.0. By supplying a crafted value to the refresh parameter of demo/portfolioPublish, an attacker can inject arbitrary script/HTML. Root cause: improper validation/neutralization of inp...

CVE-2013-3060

CVE-2013-3060 affects Apache ActiveMQ pre-5.8.0, where the web console did not require authentication. This allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests. Public sources in the provided documents (e.g., ActiveMQ advisories and related Red H...

CVE-2010-0684

Apache ActiveMQ (the server) is affected by CVE-2010-0684 due to an input validation flaw in the createDestination.action handler. The JMSDestination parameter can be exploited to inject arbitrary script/HTML in the admin UI, leading to cross-site scripting. The issue requires an authenticated re...

CVE-2026-39304

The Apache ActiveMQ messaging middleware (including Client and Broker components) is vulnerable to a Denial of Service (DoS) via Out of Memory (OOM) . The root cause is the incorrect handling of TLSv1.3 handshake KeyUpdates within the ActiveMQ NIO SSL transports . A malicious client can rapidly t...

CVE-2010-1244

Apache ActiveMQ contains a CSRF vulnerability in createDestination.action that affects releases prior to 5.3.1. An attacker could remotely hijack an authenticated user’s session to create queues via the JMSDestination parameter in a queue action. The issue is documented across multiple sources ty...

CVE-2026-41044

An improper input validation and code injection vulnerability exists in Apache ActiveMQ , Apache ActiveMQ Broker , and Apache ActiveMQ All (versions before 5.19.6 and 6.0.0 to 6.2.5). An authenticated attacker can use the admin web console to craft a malicious broker name that bypasses validation...

CVE-2026-74761

Improper input validation in TopicRegion allows an authenticated client to spoof clientId when removing a durable topic subscription. This flaw in Apache ActiveMQ , Apache ActiveMQ Broker , and Apache ActiveMQ All (all platforms) can enable the unauthorized removal of other users' durable topic s...

CVE-2026-33227

Apache ActiveMQ products, including ActiveMQ Client , Broker , All , Web , and the core ActiveMQ project, are vulnerable to a classpath path resource loading vulnerability (CWE-22 ). An authenticated user can provide a crafted "key" value that, due to improper path concatenation, allows for class...

CVE-2026-53917

A Memory Allocation with Excessive Size Value vulnerability (CWE-789) exists in Apache ActiveMQ , Apache ActiveMQ All , Apache ActiveMQ Client , and Apache ActiveMQ Broker . An authenticated user can trigger a Denial of Service (DoS) by sending a crafted OpenWire Message containing a large encode...

CVE-2026-52760

A Cross-site Scripting (XSS) vulnerability exists in Apache ActiveMQ and Apache ActiveMQ Web Console due to the lack of input sanitization when rendering a message ID on the browse page. An authenticated producer can craft a JMS message ID containing malicious HTML or JavaScript; when an administ...

CVE-2026-50750

An unauthenticated attacker can cause a Denial of Service (DoS) by triggering an Out of Memory (OOM) condition in Apache ActiveMQ . The vulnerability arises because an attacker can repeatedly send BrokerInfo commands without providing a ConnectionInfo , leading to a broker crash. This issue speci...

CVE-2026-49432

An Improper Input Validation vulnerability exists in Apache ActiveMQ , Apache ActiveMQ All , and Apache ActiveMQ Stomp . A remote unauthenticated peer can trigger a denial-of-service (DoS) by sending a negative content-length via an exposed STOMP connector . Specifically, for the NIO STOMP transp...

CVE-2026-53916

A Memory Allocation with Excessive Size Value vulnerability (CWE-789) exists in Apache ActiveMQ , Apache ActiveMQ All , and Apache ActiveMQ Stomp . An unauthenticated client establishing a STOMP NIO connection can transmit header bytes that do not terminate, causing the broker to buffer them inde...

CVE-2026-49877

An Improper Authorization vulnerability in Apache ActiveMQ allows authenticated low-privilege Web Console users to access //admin* paths by default. The root cause is that default Jetty settings fail to restrict these specific paths to administrative users only. This issue affects Apache ActiveMQ...

CVE-2026-54475

A Missing Authorization vulnerability (CWE-862) exists in Apache ActiveMQ (Broker, All, and standard versions). The issue stems from a failure to enforce isolation for Classic temporary destinations on the server side; while the client is expected to isolate these destinations to the connection t...

CVE-2026-50734

An unauthenticated network attacker can cause a Denial of Service (DoS) on an Apache ActiveMQ broker by sending a crafted WireFormatInfo frame containing a malicious large size value. The broker fails to validate this value during pre-authentication negotiation, triggering an Out of Memory (OOM) ...

CVE-2026-49434

An Improper Input Validation vulnerability exists in Apache ActiveMQ Broker , Apache ActiveMQ , and Apache ActiveMQ All (specifically before 5.19.8 and from 6.0.0 before 6.2.7 ). An attacker capable of publishing or modifying LDAP entries matching the configured searchBase and searchFilter can in...

CVE-2026-61487

An Improper Authorization vulnerability (CWE-285) exists in Apache ActiveMQ Broker , Apache ActiveMQ All , and Apache ActiveMQ . An authenticated low-privilege user can bypass per-destination write ACLs by targeting an ActiveMQ temporary composite destination whose physical name is a comma-separa...

CVE-2026-41043

Apache ActiveMQ and Apache ActiveMQ Web are vulnerable to a Basic XSS vulnerability due to the improper neutralization of script-related HTML tags in web pages. An authenticated attacker can inject malicious HTML content into a JMS selector field and override the content type to HTML (instead of ...

CVE-2026-59878

An Improper Input Validation vulnerability exists in Apache ActiveMQ AMQP , Apache ActiveMQ , and Apache ActiveMQ All . A remote unauthenticated peer can trigger a denial-of-service (DoS) by sending a specific frame size value to an exposed AMQP NIO connector . This causes NIO threads to crash, p...