deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2020-15842
Published: 2020-07-20
Description: Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17, and 7.2 before fix pack 5, allows man-in-the-middle attackers to execute arbitrary code via crafted serialized payloads, because of insecure deserialization.
CVSS Score: 8.1 (HIGH)
CWE: CWE-502
References: https://issues.liferay.com/browse/LPE-16963; https://portal.liferay.dev/learn/security/known-vulnerabilities/-/asset_publisher/HbL5mxmVrnXW/content/id/119317427; https://issues.liferay.com/browse/LPE-16963
CVE: CVE-2020-15009
Published: 2020-07-20
Description: AsusScreenXpertServicec.exe and ScreenXpertUpgradeServiceManager.exe in ScreenPad2_Upgrade_Tool.msi V1.0.3 for ASUS PCs with ScreenPad 1.0 (UX450FDX, UX550GDX and UX550GEX) could lead to unsigned code execution with no additional restrictions when a user puts an application at a particular path with a particular file name.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://drive.google.com/file/d/1ClzHH5Jw3PgZw74RvKrEP8xU0TUc5Ta0/view?usp=sharing; https://www.asus.com/Static_WebPage/ASUS-Product-Security-Advisory/; https://www.asus.com/support/FAQ/1043674
CVE: CVE-2020-4361
Published: 2020-07-20
Description: IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information by disclosing private IP addresses in HTTP responses. IBM X-Force ID: 178766.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/178766; https://www.ibm.com/support/pages/node/6249981; https://exchange.xforce.ibmcloud.com/vulnerabilities/178766
CVE: CVE-2020-4466
Published: 2020-07-20
Description: IBM MQ for HPE NonStop 8.0.4 and 8.1.0 could allow a remote authenticated attacker could cause a denial of service due to an error within the Queue processing function. IBM X-Force ID: 181563.
CVSS Score: 6.5 (MEDIUM)
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/181563; https://www.ibm.com/support/pages/node/6250473; https://exchange.xforce.ibmcloud.com/vulnerabilities/181563
CVE: CVE-2020-4527
Published: 2020-07-20
Description: IBM Planning Analytics 2.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the Secure flag for the session cookie in TLS mode. By intercepting its transmission within an HTTP session, an attacker could exploit this vulnerability to capture the cookie and obtain sensitive information. IBM X-Force ID: 182631.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-384
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/182631; https://www.ibm.com/support/pages/node/6249981; https://exchange.xforce.ibmcloud.com/vulnerabilities/182631
CVE: CVE-2020-12029
Published: 2020-07-20
Description: All versions of FactoryTalk View SE do not properly validate input of filenames within a project directory. A remote, unauthenticated attacker may be able to execute a crafted file on a remote endpoint that may result in remote code execution (RCE). Rockwell Automation recommends applying patch 1126289. Before installing this patch, the patch rollup dated 06 Apr 2020 or later MUST be applied. 1066644 – Patch Roll-up for CPR9 SRx.
CVSS Score: 9.0 (CRITICAL)
CWE: CWE-20, CWE-20
References: http://packetstormsecurity.com/files/160156/Rockwell-FactoryTalk-View-SE-SCADA-Unauthenticated-Remote-Code-Execution.html; https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1126944; https://us-cert.cisa.gov/ics/advisories/icsa-20-170-05
CVE: CVE-2020-14484
Published: 2020-07-20
Description: OpenClinic GA versions 5.09.02 and 5.89.05b may allow an attacker to bypass the system’s account lockout protection, which may allow brute force password attacks.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-307, CWE-307
References: https://us-cert.cisa.gov/ics/advisories/icsma-20-184-01; https://us-cert.cisa.gov/ics/advisories/icsma-20-184-01
CVE: CVE-2020-14485
Published: 2020-07-20
Description: OpenClinic GA versions 5.09.02 and 5.89.05b may allow an attacker to bypass client-side access controls or use a crafted request to initiate a session with limited functionality, which may allow execution of admin functions such as SQL queries.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-288, CWE-287
References: https://us-cert.cisa.gov/ics/advisories/icsma-20-184-01; https://us-cert.cisa.gov/ics/advisories/icsma-20-184-01
CVE: CVE-2020-14491
Published: 2020-07-20
Description: OpenClinic GA versions 5.09.02 and 5.89.05b do not properly check permissions before executing SQL queries, which may allow a low-privilege user to access privileged information.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://us-cert.cisa.gov/ics/advisories/icsma-20-184-01; https://us-cert.cisa.gov/ics/advisories/icsma-20-184-01
CVE: CVE-2020-14494
Published: 2020-07-20
Description: OpenClinic GA versions 5.09.02 and 5.89.05b contain an authentication mechanism within the system that does not provide sufficient complexity to protect against brute force attacks, which may allow unauthorized users to access the system after no more than a fixed maximum number of attempts.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-307
References: https://us-cert.cisa.gov/ics/advisories/icsma-20-184-01; https://us-cert.cisa.gov/ics/advisories/icsma-20-184-01
CVE: CVE-2020-8205
Published: 2020-07-20
Description: The uppy npm package < 1.13.2 and < 2.0.0-alpha.5 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacker to scan local or external networks or otherwise interact with internal systems.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918, CWE-918
References: https://hackerone.com/reports/891270; https://hackerone.com/reports/891270
CVE: CVE-2020-8215
Published: 2020-07-20
Description: A buffer overflow is present in canvas version <= 1.6.9, which could lead to a Denial of Service or execution of arbitrary code when it processes a user-provided image.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120, CWE-120
References: https://hackerone.com/reports/315037; https://hackerone.com/reports/315037
CVE: CVE-2020-12027
Published: 2020-07-20
Description: All versions of FactoryTalk View SE disclose the hostnames and file paths for certain files within the system. A remote, authenticated attacker may be able to leverage this information for reconnaissance efforts. Rockwell Automation recommends enabling built in security features found within FactoryTalk View SE. Users should follow guidance found in knowledge base articles 109056 and 1126943 to set up IPSec and/or HTTPs.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/160156/Rockwell-FactoryTalk-View-SE-SCADA-Unauthenticated-Remote-Code-Execution.html; https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1126944; https://us-cert.cisa.gov/ics/advisories/icsa-20-170-05
CVE: CVE-2020-12028
Published: 2020-07-20
Description: In all versions of FactoryTalk View SEA remote, an authenticated attacker may be able to utilize certain handlers to interact with the data on the remote endpoint since those handlers do not enforce appropriate permissions. Rockwell Automation recommends enabling built in security features found within FactoryTalk View SE. Users should follow guidance found in knowledge base articles 109056 and 1126943 to set up IPSec and/or HTTPs.
CVSS Score: 7.3 (HIGH)
CWE: CWE-264, CWE-306
References: http://packetstormsecurity.com/files/160156/Rockwell-FactoryTalk-View-SE-SCADA-Unauthenticated-Remote-Code-Execution.html; https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1126944; https://us-cert.cisa.gov/ics/advisories/icsa-20-170-05
CVE: CVE-2020-12031
Published: 2020-07-20
Description: In all versions of FactoryTalk View SE, after bypassing memory corruption mechanisms found in the operating system, a local, authenticated attacker may corrupt the associated memory space allowing for arbitrary code execution. Rockwell Automation recommends applying patch 1126290. Before installing this patch, the patch rollup dated 06 Apr 2020 or later MUST be applied. 1066644 – Patch Roll-up for CPR9 SRx.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119, CWE-787
References: https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1126944; https://us-cert.cisa.gov/ics/advisories/icsa-20-170-05; https://rockwellautomation.custhelp.com/app/answers/detail/a_id/1126944
CVE: CVE-2020-7680
Published: 2020-07-20
Description: docsify prior to 4.11.4 is susceptible to Cross-site Scripting (XSS). Docsify.js uses fragment identifiers (parameters after # sign) to load resources from server-side .md files. Due to lack of validation here, it is possible to provide external URLs after the /#/ (domain.com/#//attacker.com) and render arbitrary JavaScript/HTML inside docsify page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/158515/Docsify.js-4.11.4-Cross-Site-Scripting.html; http://packetstormsecurity.com/files/161495/docsify-4.11.6-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2021/Feb/71
CVE: CVE-2020-8214
Published: 2020-07-20
Description: A path traversal vulnerability in servey version < 3 allows an attacker to read content of any arbitrary file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://hackerone.com/reports/355501; https://hackerone.com/reports/355501
CVE: CVE-2020-15052
Published: 2020-07-20
Description: An issue was discovered in Artica Proxy CE before 4.28.030.418. SQL Injection exists via the Netmask, Hostname, and Alias fields.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: https://github.com/pratikshad19/CVE-2020-15052; https://github.com/pratikshad19/CVE-2020-15052
CVE: CVE-2020-15053
Published: 2020-07-20
Description: An issue was discovered in Artica Proxy CE before 4.28.030.418. Reflected XSS exists via these search fields: real time request, System Events, Proxy Events, Proxy Objects, and Firewall objects.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/pratikshad19/CVE-2020-15053; https://github.com/pratikshad19/CVE-2020-15053
CVE: CVE-2020-15111
Published: 2020-07-20
Description: In Fiber before version 1.12.6, the filename that is given in c.Attachment() (https://docs.gofiber.io/ctx#attachment) is not escaped, and therefore vulnerable for a CRLF injection attack. I.e. an attacker could upload a custom filename and then give the link to the victim. With this filename, the attacker can change the name of the downloaded file, redirect to another site, change the authorization header, etc. A possible workaround is to serialize the input before passing it to ctx.Attachment().
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-74, CWE-93, CWE-74
References: https://github.com/gofiber/fiber/pull/579/commits/f698b5d5066cfe594102ae252cd58a1fe57cf56f; https://github.com/gofiber/fiber/security/advisories/GHSA-9cx9-x2gp-9qvh; https://github.com/gofiber/fiber/pull/579/commits/f698b5d5066cfe594102ae252cd58a1fe57cf56f
CVE: CVE-2020-15118
Published: 2020-07-20
Description: In Wagtail before versions 2.7.4 and 2.9.3, when a form page type is made available to Wagtail editors through the `wagtail.contrib.forms` app, and the page template is built using Django's standard form rendering helpers such as form.as_p, any HTML tags used within a form field's help text will be rendered unescaped in the page. Allowing HTML within help text is an intentional design decision by Django; however, as a matter of policy Wagtail does not allow editors to insert arbitrary HTML by default, as this could potentially be used to carry out cross-site scripting attacks, including privilege escalation. This functionality should therefore not have been made available to editor-level users. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin. Patched versions have been released as Wagtail 2.7.4 (for the LTS 2.7 branch) and Wagtail 2.9.3 (for the current 2.9 branch). In these versions, help text will be escaped to prevent the inclusion of HTML tags. Site owners who wish to re-enable the use of HTML within help text (and are willing to accept the risk of this being exploited by editors) may set WAGTAILFORMS_HELP_TEXT_ALLOW_HTML = True in their configuration settings. Site owners who are unable to upgrade to the new versions can secure their form page templates by rendering forms field-by-field as per Django's documentation, but omitting the |safe filter when outputting the help text.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://docs.djangoproject.com/en/3.0/ref/models/fields/#django.db.models.Field.help_text; https://docs.wagtail.io/en/stable/reference/contrib/forms/index.html#usage; https://github.com/wagtail/wagtail/blob/master/docs/releases/2.9.3.rst
CVE: CVE-2020-15121
Published: 2020-07-20
Description: In radare2 before version 4.5.0, malformed PDB file names in the PDB server path cause shell injection. To trigger the problem it's required to open the executable in radare2 and run idpd to trigger the download. The shell code will execute, and will create a file called pwned in the current directory.
CVSS Score: 7.4 (HIGH)
CWE: CWE-78, CWE-78
References: https://github.com/radareorg/radare2/commit/04edfa82c1f3fa2bc3621ccdad2f93bdbf00e4f9; https://github.com/radareorg/radare2/issues/16945; https://github.com/radareorg/radare2/pull/16966
CVE: CVE-2020-15123
Published: 2020-07-20
Description: In codecov (npm package) before version 3.7.1 the upload method has a command injection vulnerability. Clients of the codecov-node library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability. A similar CVE (CVE-2020-7597 for GHSA-5q88-cjfq-g2mh) was issued but the fix was incomplete. It only blocked &, and command injection is still possible using backticks instead to bypass the sanitizer. The attack surface is low in this case. Particularly in the standard use of codecov, where the module is used directly in a build pipeline, not built against as a library in another application that may supply malicious input and perform command injection.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/advisories/GHSA-5q88-cjfq-g2mh; https://github.com/codecov/codecov-node/commit/c0711c656686e902af2cd92d6aecc8074de4d83d; https://github.com/codecov/codecov-node/pull/180
CVE: CVE-2020-3481
Published: 2020-07-20
Description: A vulnerability in the EGG archive parsing module in Clam AntiVirus (ClamAV) Software versions 0.102.0 - 0.102.3 could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to a null pointer dereference. An attacker could exploit this vulnerability by sending a crafted EGG file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process crash, resulting in a denial of service condition.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476, CWE-476
References: https://blog.clamav.net/2020/07/clamav-01024-security-patch-released.html; https://lists.debian.org/debian-lts-announce/2020/08/msg00010.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IJ67VH37NCG25PICGWFWZHSVG7PBT7MC/
CVE: CVE-2020-6871
Published: 2020-07-20
Description: The server management software module of ZTE has an authentication issue vulnerability, which allows users to skip the authentication of the server and execute some commands for high-level users. This affects: <R5300G4V03.08.0100/V03.07.0300/V03.07.0200/V03.07.0108/V03.07.0100/V03.05.0047/V03.05.0046/V03.05.0045/V03.05.0044/V03.05.0043/V03.05.0040/V03.04.0020;R8500G4V03.07.0103/V03.07.0101/V03.06.0100/V03.05.0400/V03.05.0020;R5500G4V03.08.0100/V03.07.0200/V03.07.0100/V03.06.0100>
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1013203; http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1013203
CVE: CVE-2020-6872
Published: 2020-07-20
Description: The server management software module of ZTE has a storage XSS vulnerability. The attacker inserts some attack codes through the foreground login page, which will cause the user to execute the predefined malicious script in the browser. This affects <R5300G4V03.08.0100/V03.07.0300/V03.07.0200/V03.07.0108/V03.07.0100/V03.05.0047/V03.05.0046/V03.05.0045/V03.05.0044/V03.05.0043/V03.05.0040/V03.04.0020;R8500G4V03.07.0103/V03.07.0101/V03.06.0100/V03.05.0400/V03.05.0020;R5500G4V03.08.0100/V03.07.0200/V03.07.0100/V03.06.0100>.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1013203; http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1013203
CVE: CVE-2020-15852
Published: 2020-07-20
Description: An issue was discovered in the Linux kernel 5.5 through 5.7.9, as used in Xen through 4.13.x for x86 PV guests. An attacker may be granted the I/O port permissions of an unrelated task. This occurs because tss_invalidate_io_bitmap mishandling causes a loss of synchronization between the I/O bitmaps of TSS and Xen, aka CID-cadfad870154.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: http://www.openwall.com/lists/oss-security/2020/07/21/2; http://xenbits.xen.org/xsa/advisory-329.html; https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cadfad870154e14f745ec845708bc17d166065f2
CVE: CVE-2020-1776
Published: 2020-07-20
Description: When an agent user is renamed or set to invalid the session belonging to the user is keept active. The session can not be used to access ticket data in the case the agent is invalid. This issue affects ((OTRS)) Community Edition: 6.0.28 and prior versions. OTRS: 7.0.18 and prior versions, 8.0.4. and prior versions.
CVSS Score: 3.5 (LOW)
CWE: CWE-613, CWE-613
References: https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html; https://otrs.com/release-notes/otrs-security-advisory-2020-13/; https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
CVE: CVE-2020-3442
Published: 2020-07-20
Description: The DuoConnect client enables users to establish SSH connections to hosts protected by a DNG instance. When a user initiates an SSH connection to a DNG-protected host for the first time using DuoConnect, the user’s browser is opened to a login screen in order to complete authentication determined by the contents of the '-relay' argument. If the ‘-relay’ is set to a URL beginning with "http://", then the browser will initially attempt to load the URL over an insecure HTTP connection, before being immediately redirected to HTTPS (in addition to standard redirect mechanisms, the DNG uses HTTP Strict Transport Security headers to enforce this). After successfully authenticating to a DNG, DuoConnect stores an authentication token in a local system cache, so users do not have to complete this browser-based authentication workflow for every subsequent SSH connection. These tokens are valid for a configurable period of time, which defaults to 8 hours. If a user running DuoConnect already has a valid token, then instead of opening a web browser, DuoConnect directly contacts the DNG, again using the configured '-relay' value, and sends this token, as well as the intended SSH server hostname and port numbers. If the '-relay' argument begins with "http://", then this request will be sent over an insecure connection, and could be exposed to an attacker who is sniffing the traffic on the same network. The DNG authentication tokens that may be exposed during SSH relay may be used to gain network-level access to the servers and ports protected by that given relay host. The DNG provides network-level access only to the protected SSH servers. It does not interact with the independent SSH authentication and encryption. An attacker cannot use a stolen token on its own to authenticate against a DNG-protected SSH server.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-319, CWE-319
References: https://duo.com/labs/psa/duo-psa-2020-003; https://duo.com/labs/psa/duo-psa-2020-003
CVE: CVE-2020-6100
Published: 2020-07-20
Description: An exploitable memory corruption vulnerability exists in AMD atidxx64.dll 26.20.15019.19000 graphics driver. A specially crafted pixel shader can cause memory corruption vulnerability. An attacker can provide a specially crafted shader file to trigger this vulnerability. This vulnerability potentially could be triggered from guest machines running virtualization environments (ie. VMware, qemu, VirtualBox etc.) in order to perform guest-to-host escape - as it was demonstrated before (TALOS-2018-0533, TALOS-2018-0568, etc.). Theoretically this vulnerability could be also triggered from web browser (using webGL and webassembly). This vulnerability was triggered from HYPER-V guest using RemoteFX feature leading to executing the vulnerable code on the HYPER-V host (inside of the rdvgm.exe process).
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1040; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1040
CVE: CVE-2020-6101
Published: 2020-07-20
Description: An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.dll 26.20.15019.19000. An attacker can provide a specially crafted shader file to trigger this vulnerability, resulting in code execution. This vulnerability can be triggered from a HYPER-V guest using the RemoteFX feature, leading to executing the vulnerable code on the HYPER-V host (inside of the rdvgm.exe process). Theoretically this vulnerability could be also triggered from web browser (using webGL and webassembly).
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1041; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1041
CVE: CVE-2020-6102
Published: 2020-07-20
Description: An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.dll 26.20.15019.19000. An attacker can provide a a specially crafted shader file to trigger this vulnerability, resulting in code execution. This vulnerability can be triggered from a HYPER-V guest using the RemoteFX feature, leading to executing the vulnerable code on the HYPER-V host (inside of the rdvgm.exe process). Theoretically this vulnerability could be also triggered from web browser (using webGL and webassembly).
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-787
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1042; https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1042
CVE: CVE-2020-6103
Published: 2020-07-20
Description: An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.dll 26.20.15019.19000. An attacker can provide a a specially crafted shader file to trigger this vulnerability, resulting in code execution. This vulnerability can be triggered from a HYPER-V guest using the RemoteFX feature, leading to executing the vulnerable code on the HYPER-V host (inside of the rdvgm.exe process). Theoretically this vulnerability could be also triggered from web browser (using webGL and webassembly).
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-787
References: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1043; https://talosintelligence.com/vulnerability_reports/TALOS-2020-1043
CVE: CVE-2020-13932
Published: 2020-07-20
Description: In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console's browser. The XSS payload is triggered in the diagram plugin; queue node and the info section.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://activemq.apache.org/security-advisories.data/CVE-2020-13932-announcement.txt; https://lists.apache.org/thread.html/r7fcedcc89e5f296b174d6b8c1438c607c30d809c04292e5732d6e4eb%40%3Cusers.activemq.apache.org%3E; https://lists.apache.org/thread.html/rb2fd3bf2dce042e0ab3f3c94c4767c96bb2e7e6737624d63162df36d%40%3Ccommits.activemq.apache.org%3E