https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 15:08:48 +0000 https://cve.radiocsirt.org/vuln/cve-2026-42588 <p><strong>Affected:</strong> Apache Software Foundation Apache ActiveMQ Broker, Apache Software Foundation Apache ActiveMQ All, Apache Software Foundation Apache ActiveMQ</p> <p>Improper Input Validation, Improper Control of Generation of Code (&#39;Code Injection&#39;) vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.</p> <p>Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String).</p> <p>An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport&#39;s brokerConfig parameter using the &#34;masterslave:// &#34; URL which can allow loading a Spring XML application context using ResourceXmlApplicationContext. Because Spring&#39;s ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker&#39;s JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.</p> <p>Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue.</p> <p><strong>Affected:</strong> Apache Software Foundation Apache ActiveMQ Broker, Apache Software Foundation Apache ActiveMQ All, Apache Software Foundation Apache ActiveMQ</p> <p>Improper Input Validation, Improper Control of Generation of Code (&#39;Code Injection&#39;) vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.</p> <p>Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations on all ActiveMQ MBeans (org.apache.activemq:*), including BrokerService.addNetworkConnector(String).</p> <p>An authenticated attacker can invoke these operations with a crafted discovery URI that triggers the VM transport&#39;s brokerConfig parameter using the &#34;masterslave:// &#34; URL which can allow loading a Spring XML application context using ResourceXmlApplicationContext. Because Spring&#39;s ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker&#39;s JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ All: before 5.19.7, from 6.0.0 before 6.2.6; Apache ActiveMQ: before 5.19.7, from 6.0.0 before 6.2.6.</p> <p>Users are recommended to upgrade to version 5.19.7 or 6.2.6, which fixes the issue.</p> https://cve.radiocsirt.org/vuln/cve-2026-42588