AC
Messaging
ActiveMQ
On CISA KEVExploited in the wildRansomware-linked
76
CVEs
3
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 13High 31Medium 16Low 2
Watch
Add ActiveMQ to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-10241 | 6.1 | Apr 22 | In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL… Affected: 5.15.9 |
| CVE-2018-8006 | 6.1 | Oct 10 | An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to… Affected: 5.0.0 through 5.15.5 |
| CVE-2016-6810 | 6.1 | Jan 10 | In Apache ActiveMQ 5.x before 5.14.2, an instance of a cross-site scripting vulnerability was identified to be present in the web based administration console Affected: 5.0.0 before 5.14.2 |
| CVE-2016-0734 | 6.1 | Apr 7 | The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct… Affected: 5.0.0; 5.1.0; 5.2.0; 5.3.0; 5.3.1; 5.3.2; +21 more |
| CVE-2026-49270 | 5.9 | Jun 1 | Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Durable Subscription Disclosure via Crafted BrokerInfo (OpenWire) Affected: 5.14.0 before 5.19.7; 6.0.0 before 6.2.6 |
| CVE-2020-13920 | 5.9 | Sep 10 | Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry Affected: before 5.15.12 |
| CVE-2019-0201 | 5.9 | May 23 | An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta Affected: 5.15.9 |
| CVE-2016-0782 | 5.4 | Aug 5 | The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site… Affected: 5.1.0; 5.2.0; 5.3.0; 5.3.1; 5.3.2; 5.4.0; +22 more |
| CVE-2026-46605 | 4.3 | Jun 1 | Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Incomplete authorization during destination removal Affected: before 5.19.7; 6.0.0 before 6.2.6 |
| CVE-2026-33227 | 4.3 | Apr 7 | Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ: Improper Limitation of a Pathname to a Restricted Classpath Directory Affected: before 5.19.3; 6.0.0 before 6.2.2 |
| CVE-2017-15709 | 3.7 | Feb 13 | When using the OpenWire protocol in ActiveMQ versions 5.14.0 to 5.15.2 it was found that certain system details (such as the OS and kernel version) are exposed as plain text Affected: 5.14.0 through 5.15.2 |
| CVE-2015-7559 | 2.7 | Aug 1 | It was found that the Apache ActiveMQ client before 5.14.5 exposed a remote shutdown command in the ActiveMQConnection class Affected: before 5.14.5; 5.15.0 before 5.15.5 |
| CVE-2015-6524 | – | Aug 24 | The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which… Affected: 5.0.0; 5.1.0; 5.2.0; 5.3.0; 5.3.1; 5.3.2; +12 more |
| CVE-2014-3612 | – | Aug 24 | The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass… Affected: 5.0.0; 5.1.0; 5.2.0; 5.3.0; 5.3.1; 5.3.2; +12 more |
| CVE-2015-1830 | – | Aug 19 | Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to… Affected: 5.0.0; 5.1.0; 5.2.0; 5.3.0; 5.3.1; 5.3.2; +16 more |
| CVE-2014-8110 | – | Feb 12 | Multiple cross-site scripting (XSS) vulnerabilities in the web based administration console in Apache ActiveMQ 5.x before 5.10.1 allow remote attackers to inject arbitrary web… Affected: 5.0.0; 5.1.0; 5.2.0; 5.3.0; 5.3.1; 5.3.2; +12 more |
| CVE-2013-1880 | – | Feb 5 | Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet in the demo web application in Apache ActiveMQ before 5.9.0 allows remote attackers to inject arbitrary… Affected: through 5.8.0; 5.0.0; 5.1.0; 5.2.0; 5.3.0; 5.3.1; +8 more |
| CVE-2013-1879 | – | Jul 20 | Cross-site scripting (XSS) vulnerability in scheduled.jsp in Apache ActiveMQ 5.8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving… Affected: through 5.8.0; 5.0.0; 5.1.0; 5.2.0; 5.3.0; 5.3.1; +8 more |
| CVE-2013-3060 | – | Apr 21 | The web console in Apache ActiveMQ before 5.8.0 does not require authentication, which allows remote attackers to obtain sensitive information or cause a denial of service via… Affected: through 5.7.0; 4.0; 4.0; 4.0; 4.0.1; 4.0.2; +14 more |
| CVE-2012-6551 | – | Apr 21 | The default configuration of Apache ActiveMQ before 5.8.0 enables a sample web application, which allows remote attackers to cause a denial of service (broker resource… Affected: through 5.7.0; 4.0; 4.0; 4.0; 4.0.1; 4.0.2; +14 more |
| CVE-2012-6092 | – | Apr 21 | Multiple cross-site scripting (XSS) vulnerabilities in the web demos in Apache ActiveMQ before 5.8.0 allow remote attackers to inject arbitrary web script or HTML via (1) the… Affected: through 5.7.0; 4.0; 4.0; 4.0; 4.0.1; 4.0.2; +14 more |
| CVE-2012-5784 | – | Nov 4 | Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ,… Affected: through 5.7.0 |
| CVE-2011-4905 | – | Jan 5 | Apache ActiveMQ before 5.6.0 allows remote attackers to cause a denial of service (file-descriptor exhaustion and broker crash or hang) by sending many openwire failover:tcp://… Affected: through 5.5.1; 1.1; 1.2; 1.3; 1.4; 1.5; +26 more |
| CVE-2010-1587 | – | Apr 28 | The Jetty ResourceHandler in Apache ActiveMQ 5.x before 5.3.2 and 5.4.x before 5.4.0 allows remote attackers to read JSP source code via a // (slash slash) initial substring in a… Affected: 5.0.0; 5.1.0; 5.2.0; 5.3.0; 5.3.1; 5.4-snapshot |
| CVE-2010-1244 | – | Apr 5 | Cross-site request forgery (CSRF) vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote attackers to hijack the authentication of unspecified… Affected: through 5.3.0; 1.1; 1.2; 1.3; 1.4; 1.5; +17 more |
| CVE-2010-0684 | – | Apr 5 | Cross-site scripting (XSS) vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote authenticated users to inject arbitrary web script or HTML via… Affected: through 5.3.0; 1.1; 1.2; 1.3; 1.4; 1.5; +17 more |