Broadcom RabbitMQ Server any version

RabbitMQ: AMQP 1.0, AMQP 0-9-1, Stream Protocol loopback enforcement can lead to remote guest sessions due to listener-address loopback checks

RabbitMQ: UNC SSRF affecting the management UI on Windows

RabbitMQ: Direct-reply-to binding persistence can lead to unauthorized reply-channel injection and persistent phantom

RabbitMQ: Unauthenticated disclosure of OAuth client credentials via an HTTP API endpoint with certain less common OAuth 2 configurations

RabbitMQ MQTT Topic Permission Authorization Bypass

RabbitMQ installers on Windows prior to version 3.8.16 do not harden plugin directory permissions, potentially allowing attackers with sufficient local filesystem permissions to add arbitrary plugins.

RabbitMQ management HTTP API accepts request bodies larger than configured max_http_body_size

RabbitMQ Web Management Plugin DoS via heap overflow

RabbitMQ: Stream listener does not enforce configured frame-size limit during authentication, permitting unauth'd mem-exhaust DoS

Predictable credential obfuscation seed value used in rabbitmq-server

RabbitMQ: Stored XSS in RabbitMQ management UI

RabbitMQ: Topic authorization can lead to cross-tenant routing-key bypass

RabbitMQ arbitrary code execution using local binary planting

RabbitMQ Node can log Basic Auth header from an HTTP request

RabbitMQ: AMQP 0-9-1 in combination with OAuth 2: consumer persistence can lead to post-revocation message disclosure

RabbitMQ: Stored XSS federation management plugin via unsanitized consumer_tag rendering

RabbitMQ: Unsanitized vhost names allow for XSS in management UI

RabbitMQ: Passive queue/exchange declaration bypasses authorization checks, leaking queue metadata to unprivileged users

RabbitMQ XSS attack via federation and shovel endpoints