CVE-2012-5784

The CVE-2012-5784 issue concerns Apache Axis 1.4 and earlier, where the getCN/subjectAltName validation is missing, allowing MITM with arbitrary valid certificates. The flaw affects Axis-based components (e.g., PayPal-related integrations and JMS in ActiveMQ) and has led to multiple advisories (i...

CVE-2019-0201

CVE-2019-0201 affects Apache ZooKeeper up to versions 3.4.13 and 3.5.4-beta, where getACL() does not enforce permissions and returns the ACL Id in plaintext. When Digest Authentication is in use, the unsalted hash value contained in the Id field can be disclosed to unauthenticated or unprivileged...

CVE-2015-1830

CVE-2015-1830 is a directory traversal flaw in the Fileserver upload/download feature of Apache ActiveMQ 5.x (Windows). An attacker can place a JSP file in an arbitrary directory, potentially causing remote code execution or shell access by leveraging the traversal vulnerability in the fileserver...

CVE-2020-13920

CVE-2020-13920 affects Apache ActiveMQ through a JMX RMI registry authentication flaw. An unauthenticated client can bind a proxy to the jmxrmi entry, enabling MITM-style interception of credentials when users connect. Affected guidance: upgrade to a fixed ActiveMQ release (initial advisory cites...

CVE-2015-6524

CVE-2015-6524 affects Apache ActiveMQ 5.x, where the LDAPLoginModule in JAAS allows wildcard operators in usernames. This enables remote attackers to obtain credentials via brute-forcing usernames. The document set explicitly ties this vulnerability to ActiveMQ 5.x prior to 5.10.1 and notes the i...

CVE-2011-4905

CVE-2011-4905 : Apache ActiveMQ is vulnerable to denial of service via the failover path. Specifically, ActiveMQ versions before 5.6.0 can exhaust file descriptors and trigger broker crashes or hangs when remote attackers send many openwire failover:tcp:// connection requests. Remediation in the ...

CVE-2016-0782

CVE-2016-0782: Apache ActiveMQ 5.x prior to 5.11.4, 5.12.x prior to 5.12.3, and 5.13.x prior to 5.13.2 is vulnerable to cross-site scripting via the web admin console. The defect is improper validation of user-supplied input in the Admin Web console, enabling remote authenticated users to execute...

CVE-2026-49270

Issue summary: CVE-2026-49270 in Apache ActiveMQ components exposes sensitive subscription metadata when a broker with a network connector using syncDurableSubs=true answers a BrokerInfo command without authenticating the connection. Affected products/versions (per sources): Apache ActiveMQ Broke...

CVE-2010-1587

The CVE-2010-1587 issue affects Apache ActiveMQ with the Jetty ResourceHandler. It enables a remote attacker to disclose JSP source code by sending a URI beginning with // that targets (admin/index.jsp, admin/queues.jsp, or admin/topics.jsp). Affected products/versions are ActiveMQ 5.x before 5.3...

CVE-2012-6551

CVE-2012-6551 affects Apache ActiveMQ: the default configuration enables a sample web application, allowing remote attackers to cause broker resource exhaustion (DoS) via HTTP requests. Affected version: ActiveMQ before 5.8.0. Impact is denial of service to the broker; no exploitation details are...