Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ApacheActivemq5.7.0

10 matches found

CVE
CVE•added 2015/08/19 3:59 p.m.•188 views

CVE-2015-1830

Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors.

5CVSS9.1AI score0.88003EPSS
CVE
CVE•added 2016/01/08 7:59 p.m.•159 views

CVE-2015-5254

Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.

9.8CVSS8.7AI score0.77148EPSS
CVE
CVE•added 2015/08/24 2:59 p.m.•121 views

CVE-2014-3612

The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind. NOTE: this identifier...

7.5CVSS9.7AI score0.00896EPSS
CVE
CVE•added 2017/10/27 7:29 p.m.•119 views

CVE-2014-3600

XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.

9.8CVSS9.3AI score0.00391EPSS
CVE
CVE•added 2015/08/24 2:59 p.m.•109 views

CVE-2015-6524

The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack. NOTE: this identifier was SPLIT from CVE-2014-361...

5CVSS9AI score0.00896EPSS
CVE
CVE•added 2013/07/20 3:37 a.m.•101 views

CVE-2013-1879

Cross-site scripting (XSS) vulnerability in scheduled.jsp in Apache ActiveMQ 5.8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving the "cron of a message."

4.3CVSS7.4AI score0.04259EPSS
CVE
CVE•added 2016/04/07 7:59 p.m.•81 views

CVE-2016-0734

The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a (1) FRAME or (2) IFRAME element.

6.1CVSS6.1AI score0.04501EPSS
CVE
CVE•added 2016/08/05 3:59 p.m.•81 views

CVE-2016-0782

The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a...

5.4CVSS5.1AI score0.01571EPSS
CVE
CVE•added 2015/02/12 4:59 p.m.•71 views

CVE-2014-8110

Multiple cross-site scripting (XSS) vulnerabilities in the web based administration console in Apache ActiveMQ 5.x before 5.10.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

4.3CVSS8AI score0.03908EPSS
CVE
CVE•added 2014/02/05 6:55 p.m.•62 views

CVE-2013-1880

Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet in the demo web application in Apache ActiveMQ before 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the refresh parameter to demo/portfolioPublish, a different vulnerability than CVE-2012-6092.

4.3CVSS7.5AI score0.01945EPSS