WaratekVRT Sign in

Critical Activemq-client CVEs

4 CVEs, 2 exploited, 4 protected by Waratek

Reset
More filters (1)
Columns
Product activemq-client✕
Overview 4 matches · 2 exploited · 2 CISA KEV · 3 public PoC · 2 EPSS ≥ 0.5
4matches 2exploited50.0% 2CISA KEV50.0% 3public PoC75.0% 2EPSS ≥ 0.550.0%
Protected by Waratek 4 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 4 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 4 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 50.0% Working exploit published 0 0.0% Proof of concept only 1 25.0% Forecast only 0 0.0% No public exploit 1 25.0%
split by peak 2 / year
Protected by Waratek: 4 Critical: 4 blocked by ARMR today: 4 No public exploit: 1Proof of concept only: 1Exploited: 2
20162 Protected by Waratek2 Critical2 blocked by ARMR today2 Exploited1 Proof of concept only1 20171 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 20180 20190 20200 20210 20220 20231 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1
20162017201820192020202120222023
4 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-46604 Critical 2023-10-27 Protected by Waratek Exploited The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.
CVE-2014-3600 Critical 2017-10-27 Protected by Waratek No public exploit XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.
CVE-2016-3088 Critical 2016-06-01 Protected by Waratek Exploited The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.
CVE-2015-5254 Critical 2016-01-08 Protected by Waratek Proof of concept only Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.