Skip to contentApache Software Foundation vulnerabilities
Products
Show 140 moreShow less
Newest
- apache geodeApache Geode vulnerable to Exposure of Sensitive InformationCVE-2017-9797Fix available6.5 Medium
- apache wicketApache Wicket vulnerable to CSRF attacksCVE-2016-6806Fix available8.8 High
- apache wicketApache Wicket allows attackers to check for third-party librariesCVE-2014-0043Public exploitFix available5.3 Medium
- apache geodeApache Geode gfsh query vulnerabilityCVE-2017-9794Fix available4.3 Medium
- apache mesosUse after free in Apache MesosCVE-2017-9790Fix available7.5 High
- apache mesosDenial of service in Apache MesosCVE-2017-7687Fix available7.5 High
- apache commons jellyImproper Restriction of XML External Entity Reference in JellyCVE-2017-12621Fix available9.8 Critical
- apache strutsApache Struts allows entering a custom URL in a form field if built-in URLValidator is usedCVE-2017-9804Fix available7.5 High
- apache strutsThe REST Plugin in Apache Struts is using an outdated XStream libraryCVE-2017-9793Fix available7.5 High
- apache strutsApache Struts 2.0.1 uses an unintentional expression in a Freemarker tag instead of string literalCVE-2017-12611Public exploitFix availableEPSS 87.1%9.8 Critical
- apache strutsApache Struts vulnerable to possible DoS attack when using URLValidatorCVE-2016-8738Fix available5.9 Medium
- apache strutsPath Traversal in Apache StrutsCVE-2016-6795Fix available9.8 Critical
- apache tomcat, netapp 7-mode transition tool, oncommand balance +19 more +21 moreWhen running Apache Tomcat on Windows with HTTP PUTs enabled it was possible to upload a JSP file to the serverCVE-2017-12615In KEVPublic exploitFix availableEPSS 99.7%8.1 High
- apache tomcatExposure of Sensitive Information to an Unauthorized Actor in Apache TomcatCVE-2017-12616Fix availableEPSS 70.1%7.5 High
- apache solrApache Solr Kerberos delegation token functionality flawsCVE-2017-9803Fix available7.5 High
- apache http server, debian linux +1 moreApache httpd allows remote attackers to read secret data from process memory if the Limit...CVE-2017-9798Public exploitFix availableEPSS 94.7%7.5 High
- apache struts, cisco digital media manager, hosted collaboration solution +4 more +6 moreREST Plugin in Apache Struts uses an XStreamHandler with an instance of XStream for deserialization without any type filteringCVE-2017-9805In KEVPublic exploitFix availableEPSS 99.4%8.1 High
- apache brooklynCross-site Scripting In Apache BrooklynCVE-2017-3165Fix available5.4 Medium
- apache brooklynDeserialization of Untrusted Data in Apache BrooklynCVE-2016-8744Fix available8.8 High
- apache brooklynApache Brooklyn is vulnerable to cross-site request forgery (CSRF)CVE-2016-8737Fix available8.8 High
- apache hadoopExposure of Sensitive Information to an Unauthorized Actor in Apache HadoopCVE-2016-3086Fix available9.8 Critical
- apache hadoopExposure of Sensitive Information to an Unauthorized Actor in Apache HadoopCVE-2016-5001Fix available5.5 Medium
- apache ofbizThe default configuration of the Apache OFBiz framework offers a blog functionality. Different...CVE-2016-68006.1 Medium
- apache ofbizBy manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid...CVE-2016-44628.8 High
- apache atlasCross-site Scripting in Apache AtlasCVE-2017-3155Fix available6.1 Medium
- apache atlasApache Atlas produces Stack trace in error responseCVE-2017-3154Fix available7.5 High
- apache atlasCross-site Scripting in Apache AtlasCVE-2017-3153Fix available6.1 Medium
- apache atlasCross-site Scripting in Apache AtlasCVE-2017-3152Fix available6.1 Medium
- apache atlasCross-site Scripting in Apache AtlasCVE-2017-3151Fix available6.1 Medium
- apache atlasInsecure cookie storage in Apache AtlasCVE-2017-3150Fix available6.1 Medium
- apache atlasPath Traversal in Apache AtlasCVE-2016-8752Fix available7.5 High
- apache tomcatImproper Limitation of a Pathname to a Restricted Directory in Apache TomcatCVE-2017-7675Fix availableEPSS 10.1%7.5 High
- apache tomcatImproper Restriction of Operations within the Bounds of a Memory Buffer in Apache TomcatCVE-2016-6817Fix available7.5 High
- apache cxfCovert Timing Channel in Apache CXFCVE-2017-3156Fix available7.5 High
- apache cxfImproper Restriction of XML External Entity Reference in Apache CXF JAX-RSCVE-2016-8739Fix available7.5 High
- apache cxfImproper Neutralization of Input During Web Page Generation in Apache CXFCVE-2016-6812Public exploitFix available6.1 Medium
- apache subversionA maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x...CVE-2017-9800Fix availableEPSS 18.9%9.8 Critical
- apache tomcatInsufficient Verification of Data Authenticity in Apache TomcatCVE-2017-7674Fix available4.3 Medium
- apache stormApache Storm it is possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, userCVE-2017-9799Fix available8.8 High
- apache commons emailImproper Input Validation in Apache Commons EmailCVE-2017-9801Fix available7.5 High
- apache solrImproper Limitation of a Pathname ('Path Traversal') in org.apache.solr:solr-coreCVE-2017-3163Fix available7.5 High
- apache http serverA maliciously constructed HTTP/2 request could cause mod_http2 in Apache HTTP Server 2.4.24, 2.4...CVE-2017-7659Fix availableEPSS 53.9%7.5 High
- apache slingXML External Entity Reference in Apache SlingCVE-2016-6798Public exploitFix available9.8 Critical
- apache slingCross site scripting in Apache SlingCVE-2016-5394Public exploitFix available6.1 Medium
- apache openmeetingsApache OpenMeetings updates user password in insecure mannerCVE-2017-7688Fix available7.5 High
- apache openmeetingsApache OpenMeetings responds to insecure HTTP methodsCVE-2017-7685Fix available5.3 Medium
- apache openmeetingsApache OpenMeetings vulnerable to Uncontrolled Resource ConsumptionCVE-2017-7684Fix available7.5 High
- apache openmeetingsApache OpenMeetings displays Tomcat version and detailed error stack traceCVE-2017-7683Fix available7.5 High
- apache openmeetingsApache OpenMeetings vulnerable to parameter manipulation attacksCVE-2017-7682Fix available8.2 High
- apache openmeetingsApache OpenMeetings vulnerable to SQL injectionCVE-2017-7681Fix available8.8 High
- Show moreLoading…