Vulnerabilities (CVE)

Filtered by vendor Apache Subscribe
Filtered by product Activemq Artemis
Total 9 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2021-26117 4 Apache, Debian, Netapp and 1 more 8 Activemq, Activemq Artemis, Debian Linux and 5 more 2023-11-20 5.0 MEDIUM 7.5 HIGH
The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error, resulting in no check on the password.
CVE-2021-26118 2 Apache, Netapp 2 Activemq Artemis, Oncommand Workflow Automation 2023-11-07 5.0 MEDIUM 7.5 HIGH
While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the entire session. Production of advisory messages was not subject to access control in error.
CVE-2020-13932 1 Apache 1 Activemq Artemis 2023-11-07 4.3 MEDIUM 6.1 MEDIUM
In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console's browser. The XSS payload is triggered in the diagram plugin; queue node and the info section.
CVE-2022-23913 2 Apache, Netapp 3 Activemq Artemis, Active Iq Unified Manager, Oncommand Workflow Automation 2023-07-07 5.0 MEDIUM 7.5 HIGH
In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through uncontrolled resource consumption of memory.
CVE-2017-12174 2 Apache, Redhat 4 Activemq Artemis, Enterprise Linux, Hornetq and 1 more 2023-02-12 7.8 HIGH 7.5 HIGH
It was found that when Artemis and HornetQ before 2.4.0 are configured with UDP discovery and JGroups discovery a huge byte array is created when receiving an unexpected multicast message. This may result in a heap memory exhaustion, full GC, or OutOfMemoryError.
CVE-2016-4978 2 Apache, Redhat 3 Activemq Artemis, Enterprise Linux Server, Jboss Enterprise Application Platform 2023-02-12 6.0 MEDIUM 7.2 HIGH
The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ Artemis before 1.4.0 might allow remote authenticated users with permission to send messages to the Artemis broker to deserialize arbitrary objects and execute arbitrary code by leveraging gadget classes being present on the Artemis classpath.
CVE-2022-35278 2 Apache, Netapp 3 Activemq Artemis, Active Iq Unified Manager, Oncommand Workflow Automation 2022-12-13 N/A 6.1 MEDIUM
In Apache ActiveMQ Artemis prior to 2.24.0, an attacker could show malicious content and/or redirect users to a malicious URL in the web console by using HTML in the name of an address or queue.
CVE-2021-4040 2 Apache, Redhat 2 Activemq Artemis, Amq Broker 2022-08-29 N/A 5.3 MEDIUM
A flaw was found in AMQ Broker. This issue can cause a partial interruption to the availability of AMQ Broker via an Out of memory (OOM) condition. This flaw allows an attacker to partially disrupt availability to the broker through a sustained attack of maliciously crafted messages. The highest threat from this vulnerability is system availability.
CVE-2020-10727 2 Apache, Netapp 2 Activemq Artemis, Oncommand Workflow Automation 2021-09-21 2.1 LOW 5.5 MEDIUM
A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis shadow file (etc/ file) when executing the `resetUsers` operation. A local attacker can use this flaw to read the contents of the Artemis shadow file.