https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 15:54:35 +0000 https://cve.radiocsirt.org/vuln/bdu:2025-11493 bdu:2025-11493 https://cve.radiocsirt.org/vuln/bdu:2025-11493 https://cve.radiocsirt.org/vuln/bit-rabbitmq-2025-30219 <p><strong>Affected:</strong> Bitnami: rabbitmq</p> <p>RabbitMQ is a messaging and streaming broker. Versions prior to 4.0.3 are vulnerable to a sophisticated attack that could modify virtual host name on disk and then make it unrecoverable (with other on disk file modifications) can lead to arbitrary JavaScript code execution in the browsers of management UI users. When a virtual host on a RabbitMQ node fails to start, recent versions will display an error message (a notification) in the management UI. The error message includes virtual host name, which was not escaped prior to open source RabbitMQ 4.0.3 and Tanzu RabbitMQ 4.0.3, 3.13.8. An attack that both makes a virtual host fail to start and creates a new virtual host name with an XSS code snippet or changes the name of an existing virtual host on disk could trigger arbitrary JavaScript code execution in the management UI (the user&#39;s browser). Open source RabbitMQ `4.0.3` and Tanzu RabbitMQ `4.0.3` and `3.13.8` patch the issue.</p> <p><strong>Affected:</strong> Bitnami: rabbitmq</p> <p>RabbitMQ is a messaging and streaming broker. Versions prior to 4.0.3 are vulnerable to a sophisticated attack that could modify virtual host name on disk and then make it unrecoverable (with other on disk file modifications) can lead to arbitrary JavaScript code execution in the browsers of management UI users. When a virtual host on a RabbitMQ node fails to start, recent versions will display an error message (a notification) in the management UI. The error message includes virtual host name, which was not escaped prior to open source RabbitMQ 4.0.3 and Tanzu RabbitMQ 4.0.3, 3.13.8. An attack that both makes a virtual host fail to start and creates a new virtual host name with an XSS code snippet or changes the name of an existing virtual host on disk could trigger arbitrary JavaScript code execution in the management UI (the user&#39;s browser). Open source RabbitMQ `4.0.3` and Tanzu RabbitMQ `4.0.3` and `3.13.8` patch the issue.</p> https://cve.radiocsirt.org/vuln/bit-rabbitmq-2025-30219 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0353 certfr-2025-avi-0353 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0353 https://cve.radiocsirt.org/vuln/euvd-2026-225172 EUVD-2026-225172 https://cve.radiocsirt.org/vuln/euvd-2026-225172 https://cve.radiocsirt.org/vuln/fkie_cve-2025-30219 <p>RabbitMQ is a messaging and streaming broker. Versions prior to 4.0.3 are vulnerable to a sophisticated attack that could modify virtual host name on disk and then make it unrecoverable (with other on disk file modifications) can lead to arbitrary JavaScript code execution in the browsers of management UI users. When a virtual host on a RabbitMQ node fails to start, recent versions will display an error message (a notification) in the management UI. The error message includes virtual host name, which was not escaped prior to open source RabbitMQ 4.0.3 and Tanzu RabbitMQ 4.0.3, 3.13.8. An attack that both makes a virtual host fail to start and creates a new virtual host name with an XSS code snippet or changes the name of an existing virtual host on disk could trigger arbitrary JavaScript code execution in the management UI (the user&#39;s browser). Open source RabbitMQ `4.0.3` and Tanzu RabbitMQ `4.0.3` and `3.13.8` patch the issue.</p> <p>RabbitMQ is a messaging and streaming broker. Versions prior to 4.0.3 are vulnerable to a sophisticated attack that could modify virtual host name on disk and then make it unrecoverable (with other on disk file modifications) can lead to arbitrary JavaScript code execution in the browsers of management UI users. When a virtual host on a RabbitMQ node fails to start, recent versions will display an error message (a notification) in the management UI. The error message includes virtual host name, which was not escaped prior to open source RabbitMQ 4.0.3 and Tanzu RabbitMQ 4.0.3, 3.13.8. An attack that both makes a virtual host fail to start and creates a new virtual host name with an XSS code snippet or changes the name of an existing virtual host on disk could trigger arbitrary JavaScript code execution in the management UI (the user&#39;s browser). Open source RabbitMQ `4.0.3` and Tanzu RabbitMQ `4.0.3` and `3.13.8` patch the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-30219 https://cve.radiocsirt.org/vuln/msrc_cve-2025-30219 msrc_CVE-2025-30219 https://cve.radiocsirt.org/vuln/msrc_cve-2025-30219 https://cve.radiocsirt.org/vuln/oesa-2026-4028 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP4: rabbitmq-server</p> <p>RabbitMQ is an implementation of AMQP, the emerging standard for high performance enterprise messaging. The RabbitMQ server is a robust and scalable implementation of an AMQP broker. Security Fix(es):</p> <p>RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an &amp;quot;out-of-memory killer&amp;quot;-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.(CVE-2023-46118)</p> <p>RabbitMQ is a messaging and streaming broker. Versions prior to 4.0.3 are vulnerable to a sophisticated attack that could modify virtual host name on disk and then make it unrecoverable (with other on disk file modifications) can lead to arbitrary JavaScript code execution in the browsers of management UI users. When a virtual host on a RabbitMQ node fails to start, recent versions will display an error message (a notification) in the management UI. The error message includes virtual host name, which was not escaped prior to open source RabbitMQ 4.0.3 and Tanzu RabbitMQ 4.0.3, 3.13.8. An attack that both makes a virtual host fail to start and creates a new virtual host name with an XSS code snippet or changes the name of an existing virtual host on disk could trigger arbitrary JavaScript code execution in…</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP4: rabbitmq-server</p> <p>RabbitMQ is an implementation of AMQP, the emerging standard for high performance enterprise messaging. The RabbitMQ server is a robust and scalable implementation of an AMQP broker. Security Fix(es):</p> <p>RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an &amp;quot;out-of-memory killer&amp;quot;-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7.(CVE-2023-46118)</p> <p>RabbitMQ is a messaging and streaming broker. Versions prior to 4.0.3 are vulnerable to a sophisticated attack that could modify virtual host name on disk and then make it unrecoverable (with other on disk file modifications) can lead to arbitrary JavaScript code execution in the browsers of management UI users. When a virtual host on a RabbitMQ node fails to start, recent versions will display an error message (a notification) in the management UI. The error message includes virtual host name, which was not escaped prior to open source RabbitMQ 4.0.3 and Tanzu RabbitMQ 4.0.3, 3.13.8. An attack that both makes a virtual host fail to start and creates a new virtual host name with an XSS code snippet or changes the name of an existing virtual host on disk could trigger arbitrary JavaScript code execution in…</p> https://cve.radiocsirt.org/vuln/oesa-2026-4028 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15291-1 <p>erlang-rabbitmq-client-3.13.7-4.1 on GA media</p> <p>erlang-rabbitmq-client-3.13.7-4.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15291-1 https://cve.radiocsirt.org/vuln/suse-su-2025:1466-1 <p>Security update for rabbitmq-server</p> <p>Security update for rabbitmq-server</p> https://cve.radiocsirt.org/vuln/suse-su-2025:1466-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-30219 <p><strong>Affected:</strong> Ubuntu:20.04:LTS: rabbitmq-server, Ubuntu:22.04:LTS: rabbitmq-server, Ubuntu:24.04:LTS: rabbitmq-server</p> <p>RabbitMQ is a messaging and streaming broker. Versions prior to 4.0.3 are vulnerable to a sophisticated attack that could modify virtual host name on disk and then make it unrecoverable (with other on disk file modifications) can lead to arbitrary JavaScript code execution in the browsers of management UI users. When a virtual host on a RabbitMQ node fails to start, recent versions will display an error message (a notification) in the management UI. The error message includes virtual host name, which was not escaped prior to open source RabbitMQ 4.0.3 and Tanzu RabbitMQ 4.0.3, 3.13.8. An attack that both makes a virtual host fail to start and creates a new virtual host name with an XSS code snippet or changes the name of an existing virtual host on disk could trigger arbitrary JavaScript code execution in the management UI (the user&#39;s browser). Open source RabbitMQ `4.0.3` and Tanzu RabbitMQ `4.0.3` and `3.13.8` patch the issue.</p> <p><strong>Affected:</strong> Ubuntu:20.04:LTS: rabbitmq-server, Ubuntu:22.04:LTS: rabbitmq-server, Ubuntu:24.04:LTS: rabbitmq-server</p> <p>RabbitMQ is a messaging and streaming broker. Versions prior to 4.0.3 are vulnerable to a sophisticated attack that could modify virtual host name on disk and then make it unrecoverable (with other on disk file modifications) can lead to arbitrary JavaScript code execution in the browsers of management UI users. When a virtual host on a RabbitMQ node fails to start, recent versions will display an error message (a notification) in the management UI. The error message includes virtual host name, which was not escaped prior to open source RabbitMQ 4.0.3 and Tanzu RabbitMQ 4.0.3, 3.13.8. An attack that both makes a virtual host fail to start and creates a new virtual host name with an XSS code snippet or changes the name of an existing virtual host on disk could trigger arbitrary JavaScript code execution in the management UI (the user&#39;s browser). Open source RabbitMQ `4.0.3` and Tanzu RabbitMQ `4.0.3` and `3.13.8` patch the issue.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-30219 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0635 <p>Ein lokaler Angreifer kann eine Schwachstelle in RabbitMQ ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.</p> <p>Ein lokaler Angreifer kann eine Schwachstelle in RabbitMQ ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0635