Apache
Apache Qpid: vulnerabilidades y CVE
Apache Qpid tiene 16 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 0 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE16
Últimos 12 meses0
Críticas0
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2019-0223 | Alta (7.4) | 6.2% | — | 23 abr 2019 | While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS *even when… |
| CVE-2015-0203 | Media (6.5) | 8.5% | — | 21 feb 2018 | The qpidd broker in Apache Qpid 0.30 and earlier allows remote authenticated users to cause a denial of service (daemon crash) via an AMQP message with (1) an invalid range in a sequence set, (2) content-bearing methods… |
| CVE-2015-0224 | Alta (7.5) | 15% | — | 30 oct 2017 | qpidd in Apache Qpid 0.30 and earlier allows remote attackers to cause a denial of service (daemon crash) via a crafted protocol sequence set. NOTE: this vulnerability exists because of an incomplete fix for… |
| CVE-2015-0223 | Media (5) | 6.6% | — | 2 feb 2015 | Unspecified vulnerability in Apache Qpid 0.30 and earlier allows remote attackers to bypass access restrictions on qpidd via unknown vectors, related to 0-10 connection handling. |
| CVE-2014-3629 | Media (4.3) | 6.9% | — | 17 nov 2014 | XML external entity (XXE) vulnerability in the XML Exchange module in Apache Qpid 0.30 allows remote attackers to cause outgoing HTTP connections via a crafted message. |
| CVE-2013-1909 | Media (5.8) | 1.6% | — | 23 ago 2013 | The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows… |
| CVE-2012-4460 | Media (5) | 3.2% | — | 14 mar 2013 | The serializing/deserializing functions in the qpid::framing::Buffer class in Apache Qpid 0.20 and earlier allow remote attackers to cause a denial of service (assertion failure and daemon exit) via unspecified vectors.… |
| CVE-2012-4459 | Media (5) | 9.2% | — | 14 mar 2013 | Integer overflow in the qpid::framing::Buffer::checkAvailable function in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service (crash) via a crafted message, which triggers an out-of-bounds… |
| CVE-2012-4458 | Media (5) | 6.5% | — | 14 mar 2013 | The AMQP type decoder in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service (memory consumption and server crash) via a large number of zero width elements in the client-properties map in… |
| CVE-2012-4446 | Media (6.8) | 4.9% | — | 14 mar 2013 | The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass… |
| CVE-2012-2145 | Media (5) | 4.2% | — | 28 sept 2012 | Apache Qpid 0.17 and earlier does not properly restrict incoming client connections, which allows remote attackers to cause a denial of service (file descriptor consumption) via a large number of incomplete connections. |
| CVE-2012-3467 | Media (5) | 6.4% | — | 27 ago 2012 | Apache QPID 0.14, 0.16, and earlier uses a NullAuthenticator mechanism to authenticate catch-up shadow connections to AMQP brokers, which allows remote attackers to bypass authentication. |
| CVE-2011-3620 | Alta (7.5) | 5.3% | — | 3 may 2012 | Apache Qpid 0.12 does not properly verify credentials during the joining of a cluster, which allows remote attackers to obtain access to the messaging functionality and job functionality of a cluster by leveraging… |
| CVE-2009-5006 | Media (4) | 4.1% | — | 18 oct 2010 | The SessionAdapter::ExchangeHandlerImpl::checkAlternate function in broker/SessionAdapter.cpp in the C++ Broker component in Apache Qpid before 0.6, as used in Red Hat Enterprise MRG before 1.3 and other products,… |
| CVE-2009-5005 | Media (5) | 5.9% | — | 18 oct 2010 | The Cluster::deliveredEvent function in cluster/Cluster.cpp in Apache Qpid, as used in Red Hat Enterprise MRG before 1.3 and other products, allows remote attackers to cause a denial of service (daemon crash and cluster… |
| CVE-2010-3083 | Media (4.3) | 4.7% | — | 12 oct 2010 | sys/ssl/SslSocket.cpp in qpidd in Apache Qpid, as used in Red Hat Enterprise MRG before 1.2.2 and other products, when SSL is enabled, allows remote attackers to cause a denial of service (daemon outage) by connecting… |