org.apache.activemq/activemq-core vulnerabilities

Latest org.apache.activemq/activemq-core CVEs

Newest publication first

1. CVE-2013-1880 Apache ActiveMQ Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet

   Published 2014-02-05

   Medium·CVSS 4.3 EPSS 6.8%

   Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet in the demo web application in Apache ActiveMQ before 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the refresh parameter to demo/portfolioPublish, a different vulnerability tha...

2. CVE-2012-6092 Cross-site Scripting in Apache ActiveMQ

   Published 2013-04-21

   Medium·CVSS 4.3 EPSS 6.9%

   Multiple cross-site scripting (XSS) vulnerabilities in the web demos in Apache ActiveMQ before 5.8.0 allow remote attackers to inject arbitrary web script or HTML via (1) the refresh parameter to PortfolioPublishServlet.java (aka demo/portfolioPublish or Market Data Publisher), o...

3. CVE-2011-4905 Denial of Service in Apache ActiveMQ

   Published 2012-01-05

   Medium·CVSS 5.0 EPSS 8.5%

   Apache ActiveMQ before 5.6.0 allows remote attackers to cause a denial of service (file-descriptor exhaustion and broker crash or hang) by sending many openwire failover:tcp:// connection requests.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.