WaratekVRT Sign in

Medium Activemq-client CVEs with no public exploit

7 CVEs, 1 protected by Waratek

Reset
More filters (1)
Columns
Product activemq-client✕
Overview 7 matches · 1 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
7matches 1protected14.3% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 1 14.3% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 6 85.7%
Critical 0 0.0% High 0 0.0% Medium 7 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 14.3% partly blocked 0 0.0% not blocked 6 85.7% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 7 100.0%
split by peak 2 / year
No exploit published: 6Protected by Waratek: 1 Medium: 7 not blocked: 6blocked by ARMR today: 1 No public exploit: 7
20132 No exploit published2 Medium2 not blocked2 No public exploit2 20140 20151 No exploit published1 Medium1 not blocked1 No public exploit1 20162 No exploit published2 Medium2 not blocked2 No public exploit2 20170 20181 No exploit published1 Medium1 not blocked1 No public exploit1 20190 20200 20210 20220 20230 20240 20250 20261 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1
2014201620182020202220242026
7 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-33227 Medium 2026-04-07 Protected by Waratek No public exploit Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web, Apache ActiveMQ. In two instances (when creating a Stomp consumer and also browsing messages in the Web console) an authenticated user provided "key" value could be constructed to traverse the classpath due to path concatenation. As a result, the application is exposed to a classpath path resource loading vulnerability that could potentially be chained together with another attack to lead to exploit. This issue affects Apache ActiveMQ Client: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Broker: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ All: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ Web: before 5.19.3, from 6.0.0 before 6.2.2; Apache ActiveMQ: before 5.19.3, from 6.0.0 before 6.2.2. Users are recommended to upgrade to version 5.19.4 or 6.2.3, which fixes the issue. Note: 5.19.3 and 6.2.2 also fix this issue, but that is limited to non-Windows environments due to a path separator resolution bug fixed in 5.19.4 and 6.2.3.
CVE-2016-6810 Medium 2018-01-10 No exploit published No public exploit In Apache ActiveMQ 5.x before 5.14.2, an instance of a cross-site scripting vulnerability was identified to be present in the web based administration console. The root cause of this issue is improper user data output validation.
CVE-2016-0782 Medium 2016-08-05 No exploit published No public exploit The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue.
CVE-2016-0734 Medium 2016-04-07 No exploit published No public exploit The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a (1) FRAME or (2) IFRAME element.
CVE-2014-8110 Medium 2015-02-12 No exploit published No public exploit Multiple cross-site scripting (XSS) vulnerabilities in the web based administration console in Apache ActiveMQ 5.x before 5.10.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2013-1879 Medium 2013-07-20 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in scheduled.jsp in Apache ActiveMQ 5.8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving the "cron of a message."
CVE-2013-3060 Medium 2013-04-21 No exploit published No public exploit The web console in Apache ActiveMQ before 5.8.0 does not require authentication, which allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests.