VulnerableCode Package Details - pkg:maven/org.apache.activemq/activemq-all@5.4.2

Vulnerabilities affecting this package (22)

Advisory	Summary	Fixed in package version
CVE-2018-11775	TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to …	5.15.6 Vulnerable 5.15.8 Vulnerable 5.15.9 Vulnerable 5.15.10 Vulnerable 5.15.11 Vulnerable 5.15.12 Vulnerable 5.15.13 Vulnerable
CVE-2011-4905	Apache ActiveMQ before 5.6.0 allows remote attackers to cause a denial of service (file-descriptor exhaustion and broker crash or hang) …	5.15.2 Vulnerable 5.11.1 Vulnerable 5.13.2 Vulnerable 5.14.5 Vulnerable 5.15.0 Vulnerable 5.9.0 Vulnerable
CVE-2015-6524	The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators …	5.15.2 Vulnerable 5.11.1 Vulnerable 5.13.2 Vulnerable 5.14.5 Vulnerable 5.15.0 Vulnerable 5.15.6 Vulnerable 5.15.8 Vulnerable 5.15.9 Vulnerable 5.15.10 Vulnerable 5.15.11 Vulnerable 5.15.12 Vulnerable 5.15.13 Vulnerable
CVE-2014-3600	XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors …	5.15.2 Vulnerable 5.11.1 Vulnerable 5.13.2 Vulnerable 5.14.5 Vulnerable 5.15.0 Vulnerable 5.15.6 Vulnerable 5.15.8 Vulnerable 5.15.9 Vulnerable 5.15.10 Vulnerable 5.15.11 Vulnerable 5.15.12 Vulnerable 5.15.13 Vulnerable
CVE-2014-3612	The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers …	5.15.2 Vulnerable 5.11.1 Vulnerable 5.13.2 Vulnerable 5.14.5 Vulnerable 5.15.0 Vulnerable 5.15.6 Vulnerable 5.15.8 Vulnerable 5.15.9 Vulnerable 5.15.10 Vulnerable 5.15.11 Vulnerable 5.15.12 Vulnerable 5.15.13 Vulnerable
CVE-2014-3576	The processControlCommand function in broker/TransportConnection.java in Apache ActiveMQ before 5.11.0 allows remote attackers to cause a denial of service (shutdown) …	5.15.2 Vulnerable 5.11.1 Vulnerable 5.13.2 Vulnerable 5.14.5 Vulnerable 5.15.0 Vulnerable 5.15.6 Vulnerable 5.15.8 Vulnerable 5.15.9 Vulnerable 5.15.10 Vulnerable 5.15.11 Vulnerable 5.15.12 Vulnerable 5.15.13 Vulnerable
GHSA-w3w2-mpp5-92gm Aliases: CVE-2026-40466	Apache ActiveMQ Vulnerable to Improper Input Validation and Code Injection Improper Input Validation, Improper Control of Generation of Code ('Code …	5.19.6 Vulnerable
GHSA-rxpj-7qvf-xv32 Aliases: CVE-2026-34197	Authenticated Apache ActiveMQ Broker and Apache ActiveMQ users could perform RCE via Jolokia MBeans Improper Input Validation, Improper Control of …	5.19.5 Vulnerable
GHSA-5568-6qcg-g7fx Aliases: CVE-2026-39304	Apache ActiveMQ: Denial of Service via Out of Memory vulnerability Denial of Service via Out of Memory vulnerability in Apache …	5.19.4 Vulnerable
GHSA-2jp3-2923-9h52 Aliases: CVE-2026-41043	Apache ActiveMQ Vulnerable to Cross-site Scripting Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in …	5.19.6 Vulnerable
GHSA-mr6m-xj7v-3cv3 Aliases: CVE-2026-41044	Apache ActiveMQ Vulnerable to Code Injection Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache …	5.19.6 Vulnerable
GHSA-h2h4-5m64-m273 Aliases: CVE-2026-33227	Apache ActiveMQ: Improper validation and restriction of a classpath path name Improper validation and restriction of a classpath path name …	5.19.3 Vulnerable
GHSA-c825-6ph3-4h84 Aliases: CVE-2025-66168	Apache ActiveMQ is Vulnerable to Integer Overflow or Wraparound Apache ActiveMQ does not properly validate the remaining length field which …	5.19.2 Vulnerable
CVE-2022-41678	Deserialization of Untrusted Data Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, …	5.16.6 Vulnerable 5.17.4 Vulnerable
CVE-2019-0222	Code Injection In Apache ActiveMQ unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.	5.15.9 Vulnerable
CVE-2020-13947	Cross-site Scripting An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console …	5.15.14 Vulnerable 5.16.1 Vulnerable
CVE-2023-46604	Deserialization of Untrusted Data Apache ActiveMQ is vulnerable to Remote Code Execution. The vulnerability may allow a remote attacker with …	5.15.16 Vulnerable 5.16.7 Vulnerable 5.17.6 Vulnerable 5.18.3 Vulnerable
CVE-2012-6551 Aliases: GHSA-34fp-xvxp-rg22	Apache ActiveMQ default configuration subject to denial of service The default configuration of Apache ActiveMQ before 5.8.0 enables a sample …	5.8.0 Vulnerable
GHSA-v853-w46p-fv2h Aliases: CVE-2026-45505	Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Code Injection issue Improper Input Validation, Improper Control of Generation …	5.19.7 Not vulnerable
GHSA-hg6c-8mvr-jqc9 Aliases: CVE-2026-42588	Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ have a Code Injection issue Improper Input Validation, Improper Control of Generation …	5.19.7 Not vulnerable
GHSA-hf52-78x8-6w3w Aliases: CVE-2026-49270	Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All have an Exposure of Sensitive Information Through Metadata vulnerability Exposure of Sensitive …	5.19.7 Not vulnerable
CVE-2018-8006	Cross-site Scripting An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console …	5.15.6 Vulnerable 5.15.6 Vulnerable

Next non-vulnerable version	5.19.7
Latest non-vulnerable version	6.2.6
Risk score	10.0