Search for packages
| purl | pkg:maven/org.apache.activemq/activemq-all@5.15.2 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2018-11775
|
TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2018-8027
|
Apache Camel 2.20.0 to 2.20.3 and 2.21.0 Core is vulnerable to XXE in XSD validation processor. |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2017-15709
|
When using the OpenWire protocol in ActiveMQ versions 5.14.0 to 5.15.2 it was found that certain system details (such as … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2020-11971
|
Apache Camel's JMX is vulnerable to Rebind Flaw. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.x, 3.0.0 up to 3.1.0 is affected. … | There are no reported fixed by versions. |
|
CVE-2018-1270
|
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2018-1275
|
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2020-13920
|
Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is … |
Vulnerable Vulnerable |
|
CVE-2018-1257
|
Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2018-1272
|
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support … |
Vulnerable Vulnerable |
|
GHSA-w3w2-mpp5-92gm
Aliases: CVE-2026-40466 |
Apache ActiveMQ Vulnerable to Improper Input Validation and Code Injection Improper Input Validation, Improper Control of Generation of Code ('Code … |
Vulnerable |
|
GHSA-rxpj-7qvf-xv32
Aliases: CVE-2026-34197 |
Authenticated Apache ActiveMQ Broker and Apache ActiveMQ users could perform RCE via Jolokia MBeans Improper Input Validation, Improper Control of … |
Vulnerable |
|
GHSA-5568-6qcg-g7fx
Aliases: CVE-2026-39304 |
Apache ActiveMQ: Denial of Service via Out of Memory vulnerability Denial of Service via Out of Memory vulnerability in Apache … |
Vulnerable |
|
GHSA-2jp3-2923-9h52
Aliases: CVE-2026-41043 |
Apache ActiveMQ Vulnerable to Cross-site Scripting Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in … |
Vulnerable |
|
GHSA-mr6m-xj7v-3cv3
Aliases: CVE-2026-41044 |
Apache ActiveMQ Vulnerable to Code Injection Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache … |
Vulnerable |
|
GHSA-h2h4-5m64-m273
Aliases: CVE-2026-33227 |
Apache ActiveMQ: Improper validation and restriction of a classpath path name Improper validation and restriction of a classpath path name … |
Vulnerable |
|
GHSA-c825-6ph3-4h84
Aliases: CVE-2025-66168 |
Apache ActiveMQ is Vulnerable to Integer Overflow or Wraparound Apache ActiveMQ does not properly validate the remaining length field which … |
Vulnerable |
|
CVE-2021-26117
|
Improper Authentication The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In … |
Vulnerable Vulnerable |
|
CVE-2022-41678
|
Deserialization of Untrusted Data Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, … |
Vulnerable Vulnerable |
|
CVE-2019-0222
|
Code Injection In Apache ActiveMQ unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive. |
Vulnerable |
|
CVE-2020-13947
|
Cross-site Scripting An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console … |
Vulnerable Vulnerable |
|
CVE-2017-15709
|
Information Exposure When using the OpenWire protocol in ActiveMQ, certain system details (such as the OS and kernel version) are … |
Vulnerable |
|
CVE-2023-46604
|
Deserialization of Untrusted Data Apache ActiveMQ is vulnerable to Remote Code Execution. The vulnerability may allow a remote attacker with … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-v853-w46p-fv2h
Aliases: CVE-2026-45505 |
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Code Injection issue Improper Input Validation, Improper Control of Generation … |
Not vulnerable |
|
GHSA-hg6c-8mvr-jqc9
Aliases: CVE-2026-42588 |
Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Code Injection issue Improper Input Validation, Improper Control of Generation … |
Not vulnerable |
|
GHSA-hf52-78x8-6w3w
Aliases: CVE-2026-49270 |
Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have an Exposure of Sensitive Information Through Metadata vulnerability Exposure of Sensitive … |
Not vulnerable |
|
CVE-2018-8006
|
Cross-site Scripting An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console … |
Vulnerable Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
CVE-2017-5643
|
Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE. | |
|
CVE-2015-0201
|
The Java SockJS client in Pivotal Spring Framework 4.1.x before 4.1.5 generates predictable session ids, which allows remote attackers to … | |
|
CVE-2017-3159
|
Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability. De-serializing untrusted data can lead to security flaws. | |
|
CVE-2016-3088
|
The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via … | |
|
CVE-2013-6429
|
The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, … | |
|
CVE-2015-0263
|
XML external entity (XXE) vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and 2.14.x before … | |
|
CVE-2011-4905
|
Apache ActiveMQ before 5.6.0 allows remote attackers to cause a denial of service (file-descriptor exhaustion and broker crash or hang) … | |
|
CVE-2013-4330
|
Apache Camel before 2.9.7, 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0 allows remote attackers to execute arbitrary simple language … | |
|
CVE-2015-6524
|
The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators … | |
|
CVE-2014-3600
|
XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors … | |
|
CVE-2015-5344
|
The camel-xstream component in Apache Camel before 2.15.5 and 2.16.x before 2.16.1 allow remote attackers to execute arbitrary commands via … | |
|
CVE-2014-1904
|
Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows … | |
|
CVE-2015-5254
|
Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote … | |
|
CVE-2013-1879
|
Cross-site scripting (XSS) vulnerability in scheduled.jsp in Apache ActiveMQ 5.8.0 and earlier allows remote attackers to inject arbitrary web script … | |
|
CVE-2016-8749
|
Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks. | |
|
CVE-2014-0002
|
The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and … | |
|
CVE-2015-0264
|
Multiple XML external entity (XXE) vulnerabilities in builder/xml/XPathBuilder.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allow remote attackers … | |
|
CVE-2014-3612
|
The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers … | |
|
CVE-2014-3576
|
The processControlCommand function in broker/TransportConnection.java in Apache ActiveMQ before 5.11.0 allows remote attackers to cause a denial of service (shutdown) … | |
|
CVE-2015-7559
|
It was found that the Apache ActiveMQ client before 5.15.5 exposed a remote shutdown command in the ActiveMQConnection class. An … |