VulnerableCode Package Details - pkg:maven/org.apache.activemq/activemq-client@5.8.0

Vulnerabilities affecting this package (27)

Advisory	Summary	Fixed in package version
CVE-2018-11775	TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to …	5.15.6 Vulnerable 5.15.7 Vulnerable 5.15.8 Vulnerable 5.15.9 Vulnerable 5.15.10 Vulnerable 5.15.11 Vulnerable 5.15.12 Vulnerable 5.15.13 Vulnerable
CVE-2014-3600	XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors …	5.10.2 Vulnerable 5.11.1 Vulnerable 5.12.0 Vulnerable 5.13.2 Vulnerable 5.13.4 Vulnerable 5.13.5 Vulnerable 5.14.3 Vulnerable 5.14.4 Vulnerable 5.14.5 Vulnerable 5.15.0 Vulnerable 5.15.2 Vulnerable 5.15.3 Vulnerable 5.15.4 Vulnerable 5.15.5 Vulnerable 5.15.6 Vulnerable 5.15.7 Vulnerable 5.15.8 Vulnerable 5.15.9 Vulnerable 5.15.10 Vulnerable 5.15.11 Vulnerable 5.15.12 Vulnerable 5.15.13 Vulnerable 5.14.0 Vulnerable
CVE-2015-5254	Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote …	5.13.2 Vulnerable 5.13.4 Vulnerable 5.13.5 Vulnerable 5.14.3 Vulnerable 5.14.4 Vulnerable 5.14.5 Vulnerable 5.15.0 Vulnerable 5.15.2 Vulnerable 5.15.3 Vulnerable 5.15.4 Vulnerable 5.15.5 Vulnerable 5.15.6 Vulnerable 5.15.7 Vulnerable 5.15.8 Vulnerable 5.15.9 Vulnerable 5.15.10 Vulnerable 5.15.11 Vulnerable 5.15.12 Vulnerable 5.15.13 Vulnerable 5.14.0 Vulnerable
CVE-2013-1879	Cross-site scripting (XSS) vulnerability in scheduled.jsp in Apache ActiveMQ 5.8.0 and earlier allows remote attackers to inject arbitrary web script …	5.10.0 Vulnerable 5.10.2 Vulnerable 5.11.1 Vulnerable 5.12.0 Vulnerable 5.13.2 Vulnerable 5.13.4 Vulnerable 5.13.5 Vulnerable 5.14.3 Vulnerable 5.14.4 Vulnerable 5.14.5 Vulnerable 5.15.0 Vulnerable 5.15.2 Vulnerable 5.15.11 Vulnerable 5.14.0 Vulnerable
CVE-2015-7559	It was found that the Apache ActiveMQ client before 5.15.5 exposed a remote shutdown command in the ActiveMQConnection class. An …	5.14.5 Vulnerable 5.15.0 Vulnerable 5.15.2 Vulnerable 5.15.3 Vulnerable 5.15.4 Vulnerable 5.15.5 Vulnerable 5.15.6 Vulnerable 5.15.7 Vulnerable 5.15.8 Vulnerable 5.15.9 Vulnerable 5.15.10 Vulnerable 5.15.11 Vulnerable 5.15.12 Vulnerable 5.15.13 Vulnerable
GHSA-whxr-3p84-rf3c Aliases: CVE-2025-27533	Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ. …	5.16.8 Vulnerable
GHSA-mfhr-3xmc-r2gg Aliases: CVE-2013-1879	Improper Neutralization of Input During Web Page Generation in Apache ActiveMQ Cross-site scripting (XSS) vulnerability in scheduled.jsp in Apache ActiveMQ …	5.9.0 Vulnerable
GHSA-9cvr-8xq4-2m73 Aliases: CVE-2014-8110	Improper Neutralization of Input During Web Page Generation in Apache ActiveMQ Multiple cross-site scripting (XSS) vulnerabilities in the web based …	5.10.1 Vulnerable
GHSA-jpv3-g4cc-6vfx Aliases: CVE-2019-0222	Improper Control of Generation of Code ('Code Injection') in org.apache.activemq:activemq-client In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame …	5.15.9 Vulnerable
GHSA-crg9-44h2-xw35 Aliases: CVE-2023-46604	Apache ActiveMQ is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker with network access to a broker …	5.15.16 Vulnerable
GHSA-5568-6qcg-g7fx Aliases: CVE-2026-39304	Apache ActiveMQ: Denial of Service via Out of Memory vulnerability Denial of Service via Out of Memory vulnerability in Apache …	5.19.4 Not vulnerable
GHSA-h2h4-5m64-m273 Aliases: CVE-2026-33227	Apache ActiveMQ: Improper validation and restriction of a classpath path name Improper validation and restriction of a classpath path name …	5.19.3 Vulnerable
CVE-2015-7559 Aliases: GHSA-jvpp-hxjj-5ccc	Improper Input Validation It was found that the Apache ActiveMQ client before 5.15.5 exposed a remote shutdown command in the …	5.15.5 Vulnerable
CVE-2014-3612 Aliases: GHSA-72m6-23ff-7q26	Improper Authentication The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows …	5.10.1 Vulnerable
CVE-2015-6524 Aliases: GHSA-23cr-5hr4-rgwv	Improper Input Validation in Apache ActiveMQ The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ …	5.10.2 Vulnerable
CVE-2020-13947	Cross-site Scripting An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console …	5.16.1 Vulnerable 5.15.14 Vulnerable
GHSA-m9w8-v359-9ffr Aliases: CVE-2018-11775	Improper Certificate Validation in Apache activemq-client TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which …	5.15.6 Vulnerable 5.15.6 Vulnerable
GHSA-rxqh-fc23-gxp2 Aliases: CVE-2016-3088	Improper Input Validation in Apache ActiveMQ The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to …	5.14.0 Vulnerable 5.14.0 Vulnerable
GHSA-q9hr-3pg4-3jp4 Aliases: CVE-2015-5254	Improper Input Validation in Apache ActiveMQ Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized …	5.11.3 Vulnerable 5.11.3 Vulnerable
GHSA-3wfj-vh84-732p Aliases: CVE-2014-3576	Improper Neutralization of Special Elements used in an OS Command in Apache ActiveMQ The processControlCommand function in broker/TransportConnection.java in Apache …	5.11.0 Vulnerable 5.11.0 Vulnerable
GHSA-4vhf-2hv7-8mrx Aliases: CVE-2014-3600	Improper Restriction of XML External Entity Reference in Apache ActiveMQ XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before …	5.10.1 Vulnerable 5.10.1 Vulnerable
GHSA-jvpp-hxjj-5ccc Aliases: CVE-2015-7559	Improper Input Validation and Missing Authentication for Critical Function in Apache ActiveMQ It was found that the Apache ActiveMQ client …	5.14.5 Vulnerable 5.14.5 Vulnerable
CVE-2015-5254 Aliases: GHSA-q9hr-3pg4-3jp4	Improper Input Validation Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, …	5.13.0 Vulnerable 5.13.0 Vulnerable
GHSA-w525-w93j-rxgm Aliases: CVE-2016-0734	Improper Neutralization of Input During Web Page Generation in Apache ActiveMQ The web-based administration console in Apache ActiveMQ 5.x before …	5.13.2 Vulnerable 5.13.2 Vulnerable 5.13.2 Vulnerable
GHSA-5jg4-p78r-p5j3 Aliases: CVE-2016-6810	Improper Neutralization of Input During Web Page Generation Apache ActiveMQ In Apache ActiveMQ 5.x before 5.14.2, an instance of a …	5.14.2 Vulnerable 5.14.2 Vulnerable 5.14.2 Vulnerable
GHSA-3v63-f83x-37x4 Aliases: CVE-2015-1830	Improper Limitation of a Pathname to a Restricted Directory in Apache ActiveMQ Directory traversal vulnerability in the fileserver upload/download functionality …	5.11.2 Vulnerable 5.11.2 Vulnerable
GHSA-8rcq-p4gh-vmj8 Aliases: CVE-2016-0782	Improper Neutralization of Input During Web Page Generation in Apache ActiveMQ The administration web console in Apache ActiveMQ 5.x before …	5.11.4 Vulnerable 5.12.3 Vulnerable 5.13.2 Vulnerable 5.11.4 Vulnerable 5.12.3 Vulnerable 5.13.2 Vulnerable 5.11.4 Vulnerable

Next non-vulnerable version	5.19.4
Latest non-vulnerable version	6.2.4
Risk score	10.0

Advisory	Summary	Aliases
CVE-2011-4905	Apache ActiveMQ before 5.6.0 allows remote attackers to cause a denial of service (file-descriptor exhaustion and broker crash or hang) …
CVE-2017-15709	When using the OpenWire protocol in ActiveMQ versions 5.14.0 to 5.15.2 it was found that certain system details (such as …
GHSA-p358-58jj-hp65	Improper Authentication in Apache ActiveMQ The web console in Apache ActiveMQ before 5.8.0 does not require authentication, which allows remote …	CVE-2013-3060