CVE-2015-7559

CVE-2015-7559: Apache ActiveMQ client before 5.14.5 exposes a remote shutdown command in ActiveMQConnection, enabling a remote authenticated attacker to cause denial of service on a connected client. Affected software is the Apache ActiveMQ client (pre-5.14.5). Remediation: upgrade to 5.14.5 or l...

CVE-2013-1879

CVE-2013-1879 is a Cross-site scripting (XSS) vulnerability in scheduled.jsp of Apache ActiveMQ 5.8.0 and earlier, allowing remote attackers to inject arbitrary script via the cron-of-a-message vector. The IBM/PSirt references note the vulnerability details and base score (4.3) with the same vect...

CVE-2017-15709

CVE-2017-15709 affects ActiveMQ when using the OpenWire protocol (versions 5.14.0–5.15.2), where certain system details (e.g., OS/kernel version) are exposed as plaintext, enabling information disclosure. Remediation per connected docs: upgrade to a fixed ActiveMQ release (e.g., 5.15.3+ or the De...

CVE-2012-6092

Summary of CVE-2012-6092: Cross-site scripting in Apache ActiveMQ web demos Affected software: Apache ActiveMQ web demos (demo/portfolioPublish and related webapp/websocket/chat.js) prior to 5.8.0. What is vulnerable: Multiple XSS vulnerabilities via (1) refresh parameter to PortfolioPublishServl...

CVE-2014-8110

Apache ActiveMQ (5.x) prior to 5.10.1 is affected by cross-site scripting in the web-based admin console (CVE-2014-8110). Attacks could inject script/HTML via unspecified vectors and, per related IBM advisories, could lead to credential theft via cookies. Remote exploitation is possible if expose...

CVE-2026-46605

CVE-2026-46605 affects Apache ActiveMQ brokers. Insecure authorization allows authenticated users to remove existing destinations when permissions exist, before versions 6.2.6 (and 5.19.7) were released. Affected ranges include: Apache ActiveMQ Broker: before 5.19.7; from 6.0.0 before 6.2.6; Apac...

CVE-2013-1880

CVE-2013-1880 (ActiveMQ) : XSS in the Portfolio publisher servlet of the Apache ActiveMQ demo web app prior to 5.9.0. By supplying a crafted value to the refresh parameter of demo/portfolioPublish, an attacker can inject arbitrary script/HTML. Root cause: improper validation/neutralization of inp...

CVE-2026-33227

CVE-2026-33227 affects Apache ActiveMQ family (Client, Broker, All, Web) via an improper validation and restriction of classpath path name. In two contexts (creating a Stomp consumer and browsing Web console messages), an authenticated user could craft a key to traverse the classpath due to path ...