Jboss A-mq (Redhat) - vulnerabilities (CVEs)
17 CVEs, 0 in the last 30 days, 6 known versions, newest CVE from 2023-10-10. Vendor: Redhat.
CVEs of Jboss A-mq
- CVE-2023-44487 - CVSS 7.5 (high), 2023-10-10: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the…
- CVE-2023-4066 - CVSS 5.5 (medium), 2023-09-27: A flaw was found in Red Hat's AMQ Broker, which stores certain passwords in a secret security-properties-prop-module, defined in ActivemqArtemisSecurity CR;…
- CVE-2023-4065 - CVSS 5.5 (medium), 2023-09-27: A flaw was found in Red Hat AMQ Broker Operator, where it displayed a password defined in ActiveMQArtemisAddress CR, shown in plain text in the Operator Log.…
- CVE-2023-1664 - CVSS 6.5 (medium), 2023-05-26: A flaw was found in Keycloak. This flaw depends on a non-default configuration "Revalidate Client Certificate" to be enabled and the reverse proxy is not…
- CVE-2022-1278 - CVSS 7.5 (high), 2022-09-13: A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.
- CVE-2020-14379 - CVSS 5.6 (medium), 2022-08-16: A flaw was found in Red Hat AMQ Broker in a way that a XEE attack can be done via Broker's configuration files, leading to denial of service and information…
- CVE-2021-4104 - CVSS 7.5 (high), 2021-12-14: JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can…
- CVE-2021-3425 - CVSS 4.4 (medium), 2021-06-01: A flaw was found in the AMQ Broker that discloses JDBC encrypted usernames and passwords when provided in the AMQ Broker application logfile when using the…
- CVE-2021-3536 - CVSS 4.8 (medium), 2021-05-20: A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible to add a payload in…
- CVE-2015-7559 - CVSS 2.7 (low), 2019-08-01: It was found that the Apache ActiveMQ client before 5.14.5 exposed a remote shutdown command in the ActiveMQConnection class. An attacker logged into a…
- CVE-2016-8653 - CVSS 5.3 (medium), 2018-08-01: It was found that the JMX endpoint of Red Hat JBoss Fuse 6, and Red Hat A-MQ 6 deserializes the credentials passed to it. An attacker could use this flaw to…
- CVE-2016-8648 - CVSS 7.2 (high), 2018-08-01: It was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x, deserializes objects passed to MBeans via JMX operations. An…
- CVE-2015-7501 - CVSS 9.8 (critical), 2017-11-09: Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform…
- CVE-2015-5183 - CVSS 7.5 (high), 2017-09-25: Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ.
- CVE-2015-5181 - CVSS 5.4 (medium), 2017-09-25: The JBoss console in A-MQ allows remote attackers to execute arbitrary JavaScript.
- CVE-2014-0085 - CVSS 2.1 (low), 2014-04-17: JBoss Fuse did not enable encrypted passwords by default in its usage of Apache Zookeeper. This permitted sensitive information disclosure via logging to…
- CVE-2013-4372 - CVSS 4.3 (medium), 2013-09-30: Multiple cross-site scripting (XSS) vulnerabilities in Fuse Management Console in Red Hat JBoss Fuse 6.0.0 before patch 3 and JBoss A-MQ 6.0.0 before patch 3…
