https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 16:29:36 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-05819 bdu:2026-05819 https://cve.radiocsirt.org/vuln/bdu:2026-05819 https://cve.radiocsirt.org/vuln/bit-activemq-2022-41678 <p><strong>Affected:</strong> Bitnami: activemq</p> <p>Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.</p> <p>In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia</p> <p>org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest.</p> <p>Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest can be invoked through refection. This could lead to RCE through via various mbeans. One example is unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11.</p> <p>1 Call newRecording.</p> <p>2 Call setConfiguration. And a webshell data hides in it.</p> <p>3 Call startRecording.</p> <p>4 Call copyTo method. The webshell will be written to a .jsp file.</p> <p>The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia. A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.</p> <p><strong>Affected:</strong> Bitnami: activemq</p> <p>Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.</p> <p>In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia</p> <p>org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest.</p> <p>Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest can be invoked through refection. This could lead to RCE through via various mbeans. One example is unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11.</p> <p>1 Call newRecording.</p> <p>2 Call setConfiguration. And a webshell data hides in it.</p> <p>3 Call startRecording.</p> <p>4 Call copyTo method. The webshell will be written to a .jsp file.</p> <p>The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia. A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.</p> https://cve.radiocsirt.org/vuln/bit-activemq-2022-41678 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0228 certfr-2024-avi-0228 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0228 https://cve.radiocsirt.org/vuln/euvd-2026-258356 EUVD-2026-258356 https://cve.radiocsirt.org/vuln/euvd-2026-258356 https://cve.radiocsirt.org/vuln/fkie_cve-2022-41678 <p>Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.</p> <p>In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia</p> <p>org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest.</p> <p>Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest can be invoked through refection. This could lead to RCE through via various mbeans. One example is unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11.</p> <p>1 Call newRecording.</p> <p>2 Call setConfiguration. And a webshell data hides in it.</p> <p>3 Call startRecording.</p> <p>4 Call copyTo method. The webshell will be written to a .jsp file.</p> <p>The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia. A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.</p> <p>Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.</p> <p>In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia</p> <p>org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest.</p> <p>Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest can be invoked through refection. This could lead to RCE through via various mbeans. One example is unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11.</p> <p>1 Call newRecording.</p> <p>2 Call setConfiguration. And a webshell data hides in it.</p> <p>3 Call startRecording.</p> <p>4 Call copyTo method. The webshell will be written to a .jsp file.</p> <p>The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia. A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-41678 https://cve.radiocsirt.org/vuln/ghsa-53v4-42fg-g287 <p><strong>Affected:</strong> Maven: org.apache.activemq:apache-activemq</p> <p>Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.</p> <p>In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia</p> <p>org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest.</p> <p>Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest is able to invoke through refection.</p> <p>And then, RCE is able to be achieved via jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11.</p> <p>1 Call newRecording.</p> <p>2 Call setConfiguration. And a webshell data hides in it.</p> <p>3 Call startRecording.</p> <p>4 Call copyTo method. The webshell will be written to a .jsp file.</p> <p>The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia. A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.</p> <p><strong>Affected:</strong> Maven: org.apache.activemq:apache-activemq</p> <p>Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.</p> <p>In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia</p> <p>org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest.</p> <p>Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest is able to invoke through refection.</p> <p>And then, RCE is able to be achieved via jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11.</p> <p>1 Call newRecording.</p> <p>2 Call setConfiguration. And a webshell data hides in it.</p> <p>3 Call startRecording.</p> <p>4 Call copyTo method. The webshell will be written to a .jsp file.</p> <p>The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia. A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.</p> https://cve.radiocsirt.org/vuln/ghsa-53v4-42fg-g287 https://cve.radiocsirt.org/vuln/gsd-2022-41678 gsd-2022-41678 https://cve.radiocsirt.org/vuln/gsd-2022-41678 https://cve.radiocsirt.org/vuln/icsa-25-261-04 <p>Hitachi Energy is aware of multiple reported vulnerabilities that affect the Asset Suite product versions mentioned in this document below. If exploited these vulnerabilities can potentially impact on confidentiality, integrity and availability of the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.</p> <p>Hitachi Energy is aware of multiple reported vulnerabilities that affect the Asset Suite product versions mentioned in this document below. If exploited these vulnerabilities can potentially impact on confidentiality, integrity and availability of the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.</p> https://cve.radiocsirt.org/vuln/icsa-25-261-04 https://cve.radiocsirt.org/vuln/oesa-2023-1925 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: activemq, openEuler:20.03-LTS-SP3: activemq, openEuler:22.03-LTS: activemq, openEuler:22.03-LTS-SP1: activemq, openEuler:22.03-LTS-SP2: activemq</p> <p>The most popular and powerful open source messaging and Integration Patterns server. Security Fix(es): Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.  In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest. Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest is able to invoke through refection. And then, RCE is able to be achieved via jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11. 1 Call newRecording. 2 Call setConfiguration. And a webshell data hides in it. 3 Call startRecording. 4 Call copyTo method. The webshell will be written to a .jsp file. The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia. A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0. (CVE-2022-41678)</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: activemq, openEuler:20.03-LTS-SP3: activemq, openEuler:22.03-LTS: activemq, openEuler:22.03-LTS-SP1: activemq, openEuler:22.03-LTS-SP2: activemq</p> <p>The most popular and powerful open source messaging and Integration Patterns server. Security Fix(es): Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.  In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest. Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest is able to invoke through refection. And then, RCE is able to be achieved via jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11. 1 Call newRecording. 2 Call setConfiguration. And a webshell data hides in it. 3 Call startRecording. 4 Call copyTo method. The webshell will be written to a .jsp file. The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia. A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0. (CVE-2022-41678)</p> https://cve.radiocsirt.org/vuln/oesa-2023-1925 https://cve.radiocsirt.org/vuln/rhsa-2024:2944 <p>golang.org/x/crypto: empty plaintext packet causes panic golang: archive/tar: github.com/vbatts/tar-split: unbounded memory consumption when reading headers golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters prometheus/client_golang: Denial of service using InstrumentHandlerCounter golang: net/http: handle server errors after sending GOAWAY golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service ActiveMQ: Deserialization vulnerability on Jolokia that allows authenticated users to perform RCE golang: regexp/syntax: limit memory used by parsing regexps golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding golang: crypto/tls: large handshake records may cause panics golang: net/http, mime/multipart: denial of service from excessive resource consumption golang: net/http, net/textproto: denial of service from excessive memory allocation golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption golang: go/parser: Infinite loop in parsing golang: html/template: backticks not treated as string delimiters golang: html/template: improper sanitization of CSS values golang: html/template: improper handling of JavaScript whitespace golang: html/template: improper handling of empty HTML attributes</p> <p>golang.org/x/crypto: empty plaintext packet causes panic golang: archive/tar: github.com/vbatts/tar-split: unbounded memory consumption when reading headers golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters prometheus/client_golang: Denial of service using InstrumentHandlerCounter golang: net/http: handle server errors after sending GOAWAY golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service ActiveMQ: Deserialization vulnerability on Jolokia that allows authenticated users to perform RCE golang: regexp/syntax: limit memory used by parsing regexps golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding golang: crypto/tls: large handshake records may cause panics golang: net/http, mime/multipart: denial of service from excessive resource consumption golang: net/http, net/textproto: denial of service from excessive memory allocation golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption golang: go/parser: Infinite loop in parsing golang: html/template: backticks not treated as string delimiters golang: html/template: improper sanitization of CSS values golang: html/template: improper handling of JavaScript whitespace golang: html/template: improper handling of empty HTML attributes</p> https://cve.radiocsirt.org/vuln/rhsa-2024:2944 https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-41678 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: activemq, Ubuntu:Pro:18.04:LTS: activemq, Ubuntu:Pro:20.04:LTS: activemq, Ubuntu:22.04:LTS: activemq</p> <p>Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest. Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest can be invoked through refection. This could lead to RCE through via various mbeans. One example is unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11. 1 Call newRecording. 2 Call setConfiguration. And a webshell data hides in it. 3 Call startRecording. 4 Call copyTo method. The webshell will be written to a .jsp file. The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia. A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: activemq, Ubuntu:Pro:18.04:LTS: activemq, Ubuntu:Pro:20.04:LTS: activemq, Ubuntu:22.04:LTS: activemq</p> <p>Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest. Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest can be invoked through refection. This could lead to RCE through via various mbeans. One example is unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11. 1 Call newRecording. 2 Call setConfiguration. And a webshell data hides in it. 3 Call startRecording. 4 Call copyTo method. The webshell will be written to a .jsp file. The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia. A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-41678 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-3022 <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Apache ActiveMQ ausnutzen, um beliebigen Programmcode auszuführen.</p> <p>Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Apache ActiveMQ ausnutzen, um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2023-3022