CVSS: 4.0EPSS: 0%CPEs: 5EXPL: 0CVE-2015-7559 – ActiveMQ: DoS in client via shutdown command
https://notcve.org/view.php?id=CVE-2015-7559
It was found that the Apache ActiveMQ client before 5.14.5 exposed a remote shutdown command in the ActiveMQConnection class. An attacker logged into a compromised broker could use this flaw to achieve denial of service on a connected client. Se encontró que el cliente ActiveMQ de Apache anterior a versión 5.15.5, expuso un comando de apagado remoto en clase ActiveMQConnection. Un atacante que inicio sesión en un broker comprometido podría utilizar este fallo para lograr una denegación de servicio en un cliente conectado. It was found that the Apache ActiveMQ client exposed a remote shutdown command in the ActiveMQConnection class. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-7559 https://issues.apache.org/jira/browse/AMQ-6470 https://access.redhat.com/security/cve/CVE-2015-7559 https://bugzilla.redhat.com/show_bug.cgi?id=1293972 • CWE-20: Improper Input Validation CWE-306: Missing Authentication for Critical Function •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2016-8648
https://notcve.org/view.php?id=CVE-2016-8648
It was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x, deserializes objects passed to MBeans via JMX operations. An attacker could use this flaw to execute remote code on the server as the user running the Java Virtual Machine if the target MBean contain deserialization gadgets in its classpath. Se ha detectado que el contenedor Karaf empleado por Red Hat JBoss Fuse 6.x y Red Hat JBoss A-MQ 6.x deserializa los objetos que se pasan a MBeans mediante operaciones JMX. Un atacante podría emplear este error para ejecutar código remoto en el servidor como el usuario que ejecuta la máquina virtual de Java si el MBean objetivo contiene gadgets de deserialización en su ruta de clase. • http://www.securityfocus.com/bid/94513 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8648 • CWE-502: Deserialization of Untrusted Data •
CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0CVE-2016-8653
https://notcve.org/view.php?id=CVE-2016-8653
It was found that the JMX endpoint of Red Hat JBoss Fuse 6, and Red Hat A-MQ 6 deserializes the credentials passed to it. An attacker could use this flaw to launch a denial of service attack. Se ha detectado que el endpoint JMX de Red Hat JBoss Fuse 6 y Red Hat A-MQ 6 deserializa las credenciales que se les pasa. Un atacante podría explotar este error para iniciar un ataque de denegación de servicio (DoS). • http://www.securityfocus.com/bid/94544 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8653 • CWE-502: Deserialization of Untrusted Data •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2015-5183 – Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ
https://notcve.org/view.php?id=CVE-2015-5183
Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ. Consola: Atributos de HTTPOnly y Secure no establecidos en las cookies de Red Hat AMQ. It was found that Hawtio console does not set HTTPOnly or Secure attributes on cookies. An attacker could use this flaw to rerieve an authenticated user's SessionID, and possibly conduct further attacks with the permissions of the authenticated user. • http://www.securitytracker.com/id/1041750 https://access.redhat.com/errata/RHSA-2018:2840 https://bugzilla.redhat.com/show_bug.cgi?id=1249182 https://lists.apache.org/thread.html/9e3391878c6840b294155f7ba6ccb47586e317f85c1bbd15c4608bd0%40%3Cdev.activemq.apache.org%3E https://lists.apache.org/thread.html/r51c60b28154fe7b634e5f5b7a7fc7f6f060487b39a7b5e95e2c32047%40%3Cdev.activemq.apache.org%3E https://lists.apache.org/thread.html/r63480b481eb5922465da102d97d0906d8823687f99ef3255ebc32be8%40%3Cdev.activemq.apache.org%3E https://lists.apache.org/thread& •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2015-5181 – Console: script injection into queue name
https://notcve.org/view.php?id=CVE-2015-5181
The JBoss console in A-MQ allows remote attackers to execute arbitrary JavaScript. La consola JBoss en A-MQ permite que los atacantes remotos ejecuten código JavaScript de forma remota. It was found that the JBoss A-MQ console would accept a string containing JavaScript as the name of a new message queue. Execution of the UI would subsequently execute the script. An attacker could use this flaw to access sensitive information or perform other attacks. • http://rhn.redhat.com/errata/RHSA-2015-2556.html https://bugzilla.redhat.com/show_bug.cgi?id=1248804 https://rhn.redhat.com/errata/RHSA-2015-2557.html https://access.redhat.com/security/cve/CVE-2015-5181 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •