AC
Messaging
ActiveMQ
On CISA KEVExploited in the wildRansomware-linked
76
CVEs
3
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 13High 31Medium 16Low 2
Watch
Add ActiveMQ to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-46604 RansomwareIn wildKEV | 9.8 | Oct 27 | Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack Affected: 5.18.0 before 5.18.3; 5.17.0 before 5.17.6; 5.16.0 before 5.16.7; before 5.15.16 |
| CVE-2016-3088 In wildKEV | 9.8 | Jun 1 | The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request Affected: 5.0.0 before 5.14.0 |
| CVE-2021-21345 | 9.9 | Mar 22 | XStream is vulnerable to a Remote Command Execution attack Affected: before 5.15.14; 5.16.0; 5.16.1 |
| CVE-2021-21350 | 9.8 | Mar 22 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: before 5.15.14; 5.16.0; 5.16.1 |
| CVE-2021-21344 | 9.8 | Mar 22 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: before 5.15.14; 5.16.0; 5.16.1 |
| CVE-2021-21346 | 9.8 | Mar 22 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: before 5.15.14; 5.16.0; 5.16.1 |
| CVE-2021-21347 | 9.8 | Mar 22 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: before 5.15.14; 5.16.0; 5.16.1 |
| CVE-2020-11998 | 9.8 | Sep 10 | A regression has been introduced in the commit preventing JMX re-bind Affected: 5.15.12 |
| CVE-2013-7285 | 9.8 | May 15 | Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by… Affected: 5.15.8 |
| CVE-2014-3600 | 9.8 | Oct 27 | XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when… Affected: 5.0.0; 5.1.0; 5.2.0; 5.3.0; 5.3.1; 5.3.2; +12 more |
| CVE-2015-5254 | 9.8 | Jan 8 | Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted… Affected: 5.0.0; 5.1.0; 5.2.0; 5.3.0; 5.3.1; 5.3.2; +18 more |
| CVE-2021-21351 | 9.1 | Mar 22 | XStream is vulnerable to an Arbitrary Code Execution attack Affected: before 5.15.14; 5.16.0; 5.16.1 |
| CVE-2021-21342 | 9.1 | Mar 22 | A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host Affected: before 5.15.14; 5.16.0; 5.16.1 |
Showing 13