Latest apache activemq Vulnerabilities

● CVE-2022-41678

Apache ActiveMQ: Deserialization vulnerability on Jolokia that allows authenticated users to perform RCE

Apache ActiveMQ<5.16.6

Apache ActiveMQ>=5.17.0<5.17.4

maven/org.apache.activemq:apache-activemq>=5.17.0<5.17.4

maven/org.apache.activemq:apache-activemq<5.16.6

IBM Secure Proxy<=6.0.3

IBM Secure Proxy<=6.1.0

● CVE-2023-46604

Apache ActiveMQ Deserialization of Untrusted Data Vulnerability

GNU C Library

=latest

Apache ActiveMQ<5.15.16

Apache ActiveMQ>=5.16.0<5.16.7

and 24 more

● CVE-2020-13947

An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp page of Apache ActiveMQ versions 5.15.12 through 5.16.0.

IBM Security Directory Suite VA<=8.0.1-8.0.1.19

Apache ActiveMQ<5.15.14

Apache ActiveMQ>=5.16.0<5.16.1

Oracle Communications Session Report Manager>=8.0.0<=8.2.2

Oracle Communications Session Route Manager>=8.0.0<=8.2.2

maven/org.apache.activemq:activemq-parent<5.15.14

and 1 more

● CVE-2020-26217

XStream could allow a remote attacker to execute arbitrary code on the system, caused by flaws in the XStream.java and SecurityVulnerabilityTest.java scripts. By manipulating the processed input strea...

redhat/xstream<0:1.3.1-12.el7_9

debian/libxstream-java

IBM RDNG<=6.0.2

IBM DOORS Next<=7.0

IBM DOORS Next<=7.0.1

IBM DOORS Next<=7.0.2

and 56 more

● CVE-2020-11998

A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it le...

Apache ActiveMQ=5.15.12

Oracle Communications Diameter Signaling Router>=8.0.0<=8.5.0

Oracle Communications Element Manager>=8.2.0<=8.2.4.0

Oracle Communications Session Report Manager>=8.0.0<=8.2.2

Oracle Communications Session Route Manager>=8.0.0<=8.2.2

Oracle Enterprise Repository=11.1.1.7.0

and 3 more

● CVE-2020-13920

Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and cal...

redhat/Apache ActiveMQ<5.15.12

IBM Security Directory Suite VA<=8.0.1-8.0.1.19

Apache ActiveMQ<5.15.12

Oracle Communications Diameter Signaling Router>=8.0.0<=8.2.2

Oracle FLEXCUBE Private Banking=12.0.0

Oracle FLEXCUBE Private Banking=12.1.0

and 2 more

● CVE-2021-26117

ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind

Apache ActiveMQ>=5.15.0<5.15.14

Apache ActiveMQ>=5.16.0<5.16.1

Apache ActiveMQ Artemis<2.16.0

NetApp OnCommand Workflow Automation

Debian Debian Linux=9.0

Oracle Communications Element Manager>=8.2.0<=8.2.4.0

and 7 more

● CVE-2020-1941

Apache ActiveMQ is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the admin GUI. A remote attacker could exploit this vulnerability using a specially-craft...

IBM Security Directory Suite VA<=8.0.1-8.0.1.19

Apache ActiveMQ>=5.0.0<=5.15.11

Oracle Communications Diameter Signaling Router>=8.0.0<=8.2.2

Oracle Communications Element Manager=8.1.1

Oracle Communications Element Manager=8.2.0

Oracle Communications Element Manager=8.2.1

and 10 more

● CVE-2015-7559

Apache ActiveMQ client is vulnerable to a denial of service, caused by a remote shutdown command in the ActiveMQConnection class. By sending a specific command, a remote authenticated attacker could e...

IBM Security Directory Suite VA<=8.0.1-8.0.1.19

Apache ActiveMQ<5.14.5

Apache ActiveMQ>=5.15.0<5.15.5

Redhat Jboss A-mq=6.2.1

Redhat Jboss A-mq=6.3

Redhat Jboss Fuse=6.3

and 1 more

● CVE-2019-0201

A flaw was found in Apache ZooKeeper. A lack of permission checks while retrieving ACLs allows unsalted hash values to be disclosed for unauthenticated or unprivileged users.

redhat/zookeeper<3.6.0

redhat/zookeeper<3.5.5

redhat/zookeeper<3.4.14

ubuntu/zookeeper<3.4.8-1ubuntu0.1~

ubuntu/zookeeper<3.4.5+dfsg-1ubuntu0.1~

ubuntu/zookeeper<3.4.9-3+

and 34 more

● CVE-2019-10241

Eclipse Jetty is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the DefaultServlet and ResourceHandler. A remote attacker could exploit this vulnerability ...

Eclipse Jetty=9.2.0-20140523

Eclipse Jetty=9.2.0-20140526

Eclipse Jetty=9.2.0-maintenance_0

Eclipse Jetty=9.2.0-maintenance_1

Eclipse Jetty=9.2.0-rc0

Eclipse Jetty=9.2.1-20140609

and 138 more

● CVE-2019-0222

Apache ActiveMQ is vulnerable to a denial of service, caused by improper input validation. By sending a specially-crafted MQTT frame, a remote attacker could exploit this vulnerability to cause a deni...

IBM Security Directory Suite VA<=8.0.1-8.0.1.19

redhat/activemq<5.15.9

maven/org.apache.activemq:activemq-client>=5.0.0<5.15.9

debian/activemq

debian/mqtt-client

ubuntu/mqtt-client<1.14-1ubuntu0.18.04.1~

and 15 more

● CVE-2018-8006

An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cau...

IBM Security Directory Suite VA<=8.0.1-8.0.1.19

Apache ActiveMQ>=5.0.0<=5.15.5

maven/org.apache.activemq:activemq-web-console>=5.0.0<5.15.6

● CVE-2018-11775

TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM attack between a Java application using the ActiveMQ client a...

maven/org.apache.activemq:activemq-client<5.15.6

IBM Security Directory Suite VA<=8.0.1-8.0.1.19

Apache ActiveMQ<5.15.6

Oracle Enterprise Repository=12.1.3.0.0

Oracle FLEXCUBE Private Banking=2.0.0.0

Oracle FLEXCUBE Private Banking=2.2.0.1

and 3 more

Latest apache activemq Vulnerabilities

Company

Resources

Contact