CVSS: 9.8EPSS: 3%CPEs: 1EXPL: 0CVE-2017-15702
https://notcve.org/view.php?id=CVE-2017-15702
01 Dec 2017 — In Apache Qpid Broker-J 0.18 through 0.32, if the broker is configured with different authentication providers on different ports one of which is an HTTP port, then the broker can be tricked by a remote unauthenticated attacker connecting to the HTTP port into using an authentication provider that was configured on a different port. The attacker still needs valid credentials with the authentication provider on the spoofed port. This becomes an issue when the spoofed port has weaker authentication protection... • http://www.securityfocus.com/bid/102040 •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-4432 – Apache Qpid Java Broker 6.0.2 Authentication Bypass
https://notcve.org/view.php?id=CVE-2016-4432
27 May 2016 — The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication and consequently perform actions via vectors related to connection state logging. La manipulación de conexión AMQP 0-8, 0-9, 0-91 y 0-10 en Apache Qpid Java en versiones anteriores a 6.0.3 podría permitir a atacantes remotos eludir la autenticación y consecuentemente realizar acciones a través de vectores relacionados con el registro de estado de conexión. Apache Qpid ... • http://mail-archives.apache.org/mod_mbox/qpid-users/201605.mbox/%3CCAFEMS4tXDKYxKVMmU0zTb_7uzduoUS4_RePnUwz1tj%2BGQLNw5Q%40mail.gmail.com%3E • CWE-287: Improper Authentication •
CVSS: 5.9EPSS: 1%CPEs: 1EXPL: 0CVE-2016-3094 – Apache Qpid Java Broker 6.0.2 Denial of Service
https://notcve.org/view.php?id=CVE-2016-3094
27 May 2016 — PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allows remote attackers to cause a denial of service (broker termination) via a crafted authentication attempt, which triggers an uncaught exception. PlainSaslServer.java en Apache Qpid Java en versiones anteriores a 6.0.3, cuando el broker está configurado para permitir contraseñas en texto plano, permite a atacantes remotos provocar una denegación de servicio (terminación del broker) a través... • http://mail-archives.apache.org/mod_mbox/qpid-users/201605.mbox/%3C5748641A.2050701%40gmail.com%3E • CWE-20: Improper Input Validation CWE-287: Improper Authentication •