GCVE - cpe:2.3:a:apache:activemq:5.9.1:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:activemq:5.9.1:*:*:*:*:*:*:*

part: a version: 5.9.1 update: *

Vendor	Apache (`b0303047-b7dd-5cf8-abcc-71b7d9d80b95`)
Product	Activemq (`db75e7d1-71e2-5c1b-8c68-2b326744850c`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:apache/activemq`	purl2cpe	2026-06-01 10:14:26.301358
`pkg:deb/debian/activemq`	purl2cpe	2026-06-01 10:14:26.301359
`pkg:deb/ubuntu/activemq`	purl2cpe	2026-06-01 10:14:26.301360
`pkg:dokcer/pharmazon/activemq_artemis`	purl2cpe	2026-06-01 10:14:26.301362
`pkg:github/apache/activemq`	purl2cpe	2026-06-01 10:14:26.301363
`pkg:maven/org.apache.activemq/activemq`	purl2cpe	2026-06-01 10:14:26.301364
`pkg:maven/org.apache.activemq/activemq-core`	purl2cpe	2026-06-01 10:14:26.301366

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2016-0782`	vulnerable	2026-06-08 05:07:16.291045	Details available The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue. Published: 2016-08-05T15:00:00.000Z Updated: 2024-08-05T22:30:04.755Z Open on db.gcve.eu Reference links https://access.redhat.com/errata/RHSA-2016:1424 http://packetstormsecurity.com/files/136215/Apache-ActiveMQ-5.13.0-Cross-Site-Scripting.html http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt http://www.securitytracker.com/id/1035328 http://www.securityfocus.com/archive/1/537760/100/0/threaded	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-0734`	vulnerable	2026-06-08 05:07:15.979414	Details available The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a (1) FRAME or (2) IFRAME element. Published: 2016-04-07T19:00:00.000Z Updated: 2024-08-05T22:30:03.933Z Open on db.gcve.eu Reference links https://access.redhat.com/errata/RHSA-2016:1424 http://www.securitytracker.com/id/1035327 http://www.openwall.com/lists/oss-security/2016/03/10/11 http://activemq.apache.org/security-advisories.data/CVE-2016-0734-announcement.txt http://www.securityfocus.com/bid/84321	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-6524`	vulnerable	2026-06-08 05:06:52.626895	Details available The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack. NOTE: this identifier was SPLIT from CVE-2014-3612 per ADT2 due to different vulnerability types. Published: 2015-08-24T14:00:00.000Z Updated: 2024-08-06T07:22:22.231Z Open on db.gcve.eu Reference links http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168651.html http://activemq.apache.org/security-advisories.data/CVE-2014-3612-announcement.txt http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168094.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-5254`	vulnerable	2026-06-08 05:06:49.354196	Details available Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object. Published: 2016-01-08T19:00:00.000Z Updated: 2024-08-06T06:41:08.759Z Open on db.gcve.eu Reference links http://www.debian.org/security/2016/dsa-3524 http://rhn.redhat.com/errata/RHSA-2016-2035.html http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174537.html http://www.openwall.com/lists/oss-security/2015/12/08/6 http://rhn.redhat.com/errata/RHSA-2016-0489.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-1830`	vulnerable	2026-06-08 05:06:26.366390	Details available Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors. Published: 2015-08-19T15:00:00.000Z Updated: 2024-08-06T04:54:16.298Z Open on db.gcve.eu Reference links http://activemq.apache.org/security-advisories.data/CVE-2015-1830-announcement.txt http://www.securityfocus.com/bid/76452 http://www.zerodayinitiative.com/advisories/ZDI-15-407 http://www.zerodayinitiative.com/advisories/ZDI-15-407/ http://www.securitytracker.com/id/1033315	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-8110`	vulnerable	2026-06-08 05:06:07.659116	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-3612`	vulnerable	2026-06-08 05:05:33.761149	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-3600`	vulnerable	2026-06-08 05:05:33.693735	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.