Search for packages
| purl | pkg:maven/org.apache.activemq/activemq-broker@5.15.12 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-37ws-cqf7-4udm
Aliases: CVE-2020-13947 GHSA-66gw-ch5v-74v8 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp page of Apache ActiveMQ versions 5.15.12 through 5.16.0. |
Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-f5x2-zvxa-yba5
Aliases: CVE-2023-46604 GHSA-crg9-44h2-xw35 |
False positive This advisory has been marked as a false positive. |
Affected by 1 other vulnerability. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-k4jb-36cp-1fc4
Aliases: CVE-2022-41678 GHSA-53v4-42fg-g287 |
False positive This advisory has been marked as a false positive. |
Affected by 1 other vulnerability. Affected by 1 other vulnerability. |
|
VCID-pe37-xakm-3qb4
Aliases: CVE-2020-11998 GHSA-wqfh-9m4g-7x6x |
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack: https://docs.oracle.com/javase/8/docs/technotes/guides/management/agent.html "A remote client could create a javax.management.loading.MLet MBean and use it to create new MBeans from arbitrary URLs, at least if there is no security manager. In other words, a rogue remote client could make your Java application execute arbitrary code." Mitigation: Upgrade to Apache ActiveMQ 5.15.13 |
Affected by 3 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||