Skip to content
OpenAdvisories

Package · Maven

org.apache.activemq:activemq-parent

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Feed

  • Medium 6.1
    CVE-2020-13947 EPSS 79%

    Cross-site scripting (XSS) in Apache ActiveMQ

    An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp page of Apache ActiveMQ versions 5.15.12 through 5.16.0.

    activemq activemq org.apache.activemq:activemq-parent Debian Ubuntu Maven
  • High 7.5
    CVE-2021-26117 EPSS 12%

    ActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bind

    The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to …

    Apache Software Foundation Apache ActiveMQ activemq activemq Debian Ubuntu Maven
  • Critical 9.8
    CVE-2020-11998 Public exploit EPSS 49%

    Remote code execution in Apache ActiveMQ

    A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack: https://docs.or…

    activemq org.apache.activemq:activemq-parent Ubuntu Maven
  • Medium 5.9
    CVE-2020-13920

    Improper Authentication in Apache ActiveMQ

    Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If …

    activemq activemq org.apache.activemq:activemq-parent Debian Ubuntu Maven
  • Low 3.7
    CVE-2017-15709 EPSS 23%

    ActiveMQ's OpenWire protocol exposes certain system details as plain text

    When using the OpenWire protocol in ActiveMQ versions 5.14.0 to 5.15.2 it was found that certain system details (such as the OS and kernel version) are exposed as plain text.

    Apache Software Foundation Apache ActiveMQ activemq org.apache.activemq:activemq-parent Debian Maven
  • Low —
    CVE-2010-0684

    Cross-site scripting in Apache ActiveMQ

    Cross-site scripting (XSS) vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote authenticated users to inject arbitrary web script or HTML via the JMSDestination parameter in a queue action.

    org.apache.activemq:activemq-parent Maven
  • Medium —
    CVE-2010-1244

    Cross-site request forgery in Apache ActiveMQ

    Cross-site request forgery (CSRF) vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote attackers to hijack the authentication of unspecified victims for requests that create queues via the JMSDestination parameter in a queue…

    org.apache.activemq:activemq-parent Maven