Red Hat Security Advisory

RHSA-2013:1029

Fuse MQ Enterprise 7.1.0 update

Released 2013-07-09 · Red Hat rating Important · View on Red Hat →

Fixed in

Fuse MQ Enterprise 7.1.0

Fixes 6 records

TI-2013-02671 CVE-2013-3060 · GHSA-p358-58jj-hp65

The web console in Apache ActiveMQ before 5.8.0 does not require authentication, which…

LOW 38

The web console in Apache ActiveMQ before 5.8.0 does not require authentication, which allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests.

CVSS 2.0MEDIUM 6.4 Network No auth Interaction — EPSS 0.06311 Published 2013-04-21 Partial fix · 5.8.0 CWE-287

TI-2012-05269 CVE-2012-6551 · GHSA-34fp-xvxp-rg22

The default configuration of Apache ActiveMQ before 5.8.0 enables a sample web…

LOW 33

The default configuration of Apache ActiveMQ before 5.8.0 enables a sample web application, which allows remote attackers to cause a denial of service (broker resource consumption) via HTTP requests.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.07769 Published 2013-04-21 Partial fix · 5.8.0 CWE-399

TI-2013-01658 CVE-2013-1880 · GHSA-c9gx-27hq-wcvj

Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet in the demo…

LOW 30

Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet in the demo web application in Apache ActiveMQ before 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the refresh param…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.06791 Published 2014-02-05 Fixed in 5.9.0 CWE-79

TI-2012-05056 CVE-2012-6092 · GHSA-rp9p-863f-9c4h

Multiple cross-site scripting (XSS) vulnerabilities in the web demos in Apache ActiveMQ…

LOW 30

Multiple cross-site scripting (XSS) vulnerabilities in the web demos in Apache ActiveMQ before 5.8.0 allow remote attackers to inject arbitrary web script or HTML via (1) the refresh parameter to PortfolioPublishServlet.…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.06932 Published 2013-04-21 Partial fix · 5.8.0 CWE-79

TI-2013-01657 CVE-2013-1879 · GHSA-mfhr-3xmc-r2gg

Cross-site scripting (XSS) vulnerability in scheduled.jsp in Apache ActiveMQ 5.8.0 and…

LOW 29

Cross-site scripting (XSS) vulnerability in scheduled.jsp in Apache ActiveMQ 5.8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving the "cron of a message."

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.06421 Published 2013-07-18 Fixed in 5.9.0 CWE-79

TI-2013-01806 CVE-2013-2035 · GHSA-49j7-qghp-5wj8

Race condition in…

LOW 21

Race condition in hawtjni-runtime/src/main/java/org/fusesource/hawtjni/runtime/Library.java in HawtJNI before 1.8, when a custom library path is not specified, allows local users to execute arbitrary Java code by overwri…

CVSS 2.0MEDIUM 4.4 Local No auth Interaction — EPSS 0.00589 Published 2013-08-28 Partial fix · 1.8 CWE-94