Skip to contentApache Software Foundation vulnerabilities
Products
Show 140 moreShow less
Newest
- apache tikaApache Tika Denial of Service due to Infinite Loop in Tika's SQLite3ParserCVE-2018-17197Fix available6.5 Medium
- apache oozieModerate severity vulnerability that affects org.apache.oozie:oozie-coreCVE-2018-11799Fix available6.5 Medium
- apache nifiCleartext Transmission of Sensitive Information in Apache nifiCVE-2018-17195Fix available7.5 High
- apache nifiApache NiFi Improper Input Validation vulnerabilityCVE-2018-17194Fix available7.5 High
- apache nifiCross site scripting in org.apache.nifi:nifiCVE-2018-17193Fix available6.1 Medium
- apache nifiImproper Restriction of Rendered UI Layers or Frames in Apache nififCVE-2018-17192Fix available6.5 Medium
- apache ofbizIn Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine (org.apache.ofbiz.service.engine...CVE-2018-8033Public exploitEPSS 25.7%7.5 High
- apache hadoopArbitrary Command Execution in HadoopCVE-2018-11766Fix available8.8 High
- apache sparkRemote Code Execution in spark-coreCVE-2018-171909.8 Critical
- apache hadoopPath Traversal in HadoopCVE-2018-8009Fix available8.8 High
- apache qpid proton-jImproper Certificate Validation in proton-jCVE-2018-17187Fix available7.4 High
- apache hiveModerate severity vulnerability that affects org.apache.hive:hive-jdbcCVE-2018-1314Fix available4.3 Medium
- apache hiveImproper Authentication in hive:hive-execCVE-2018-11777Fix available8.1 High
- apache syncopeImproper Restriction of XML External Entity Reference in org.apache.syncope:syncope-coreCVE-2018-17186Fix available7.2 High
- apache syncopeImproper Control of Interaction Frequency in Apache syncope-coreCVE-2018-17184Fix available5.4 Medium
- apache tomcat jk connector, apache software foundation tomcat connectors, debian linux +1 more +3 moreThe Apache Web Server (httpd) specific code that normalised the requested path before matching it...CVE-2018-11759Public exploitFix availableEPSS 90.6%7.5 High
- apache impalaIn Apache Impala before 3.0.1, ALTER TABLE/VIEW RENAME required ALTER on the old table. This may...CVE-2018-117929.8 Critical
- apache impalaMissing authorization check in Apache Impala before 3.0.1 allows a Kerberos-authenticated but...CVE-2018-117856.5 Medium
- apache sparkImproper Input Validation in Apache SparkCVE-2018-118047.5 High
- apache activemqApache ActiveMQ web console vulnerable to Cross-site ScriptingCVE-2018-8006Fix availableEPSS 55.7%6.1 Medium
- apache tikaApache Tika is vulnerable to entity expansions which can lead to a denial of service attackCVE-2018-11796Fix available7.5 High
- apache pdfbox, fedoraproject fedora, oracle retail xstore point of service +2 moreIn Apache PDFBox a carefully crafted PDF file can trigger an extremely long running computationCVE-2018-11797Fix available5.5 Medium
- apache rangerUnixAuthenticationService in Apache Ranger was updated to correctly handle user input to avoid Stack-based buffer overflowCVE-2018-11778Fix available8.8 High
- apache pony mailThe statistics generator in Apache Pony Mail 0.7 to 0.9 was found to be returning timestamp data...CVE-2017-56585.3 Medium
- apache tomcat, canonical ubuntu linux, debian linux +12 more +14 moreApache Tomcat Open Redirect vulnerabilityCVE-2018-11784Public exploitFix availableEPSS 97.7%4.3 Medium
- apache http server, canonical ubuntu linux, netapp storage automation store +6 more +8 moreIn Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can...CVE-2018-11763Fix availableEPSS 51.0%5.9 Medium
- apache mesosModerate severity vulnerability that affects org.apache.mesos:mesosCVE-2018-8023Fix available5.9 Medium
- apache tikaComparison errorr in org.apache.tika:tika-coreCVE-2018-8017Fix available5.5 Medium
- apache tikaModerate severity vulnerability that affects org.apache.tika:tika-coreCVE-2018-11762Fix available5.9 Medium
- apache tika, oracle business process management suite +1 moreHigh severity vulnerability that affects org.apache.tika:tika-coreCVE-2018-11761Public exploitFix available7.5 High
- apache karafImproper Authentication in Apache KarafCVE-2018-11787Fix available8.1 High
- apache karafImproper Privilege Management in Apache KarafCVE-2018-11786Fix available8.8 High
- apache camelApache Camel's Mail is vulnerable to path traversalCVE-2018-8041Public exploitFix available5.3 Medium
- apache spamassassin, canonical ubuntu linux, debian linux +4 more +6 moreApache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax.CVE-2018-11781Fix available7.8 High
- apache spamassassin, pdfinfo project pdfinfo, canonical ubuntu linux +1 more +3 moreA potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin...CVE-2018-11780Fix availableEPSS 10.8%9.8 Critical
- apache spamassassin, canonical ubuntu linux, debian linux +4 more +6 moreA denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2....CVE-2017-15705Fix available5.3 Medium
- apache mesosCrash when decoding malformed HTTP requests or malformed JSON payloadCVE-2018-1330Fix available7.5 High
- apache activemq, oracle enterprise repository, flexcube private banking +2 moreImproper Certificate Validation in Apache activemq-clientCVE-2018-11775Fix available7.4 High
- apache traffic server, debian linux +1 morePages that are rendered using the ESI plugin can have access to the cookie header when the plugin...CVE-2018-8040Fix available5.3 Medium
- apache traffic serverA carefully crafted invalid TLS handshake can cause Apache Traffic Server (ATS) to segfault. This...CVE-2018-8022Fix available7.5 High
- apache traffic server, debian linux +1 moreWhen there are multiple ranges in a range request, Apache Traffic Server (ATS) will read the...CVE-2018-8005Fix available5.3 Medium
- apache traffic server, debian linux +1 moreThere are multiple HTTP smuggling and cache poisoning issues when clients making malicious...CVE-2018-8004Public exploitFix available6.5 Medium
- apache traffic server, debian linux +1 moreAdding method ACLs in remap.config can cause a segfault when the user makes a carefully crafted...CVE-2018-1318Fix available7.5 High
- apache sentryApache Sentry may allow attacker to access/remove data from Sentry protected tableCVE-2018-8028Fix available8.8 High
- apache cayenneXML External Entity Reference in Apache CayenneCVE-2018-11758Fix available8.1 High
- apache struts, netapp active iq unified manager, oncommand insight +5 more +7 moreApache Struts vulnerable to remote command execution (RCE) due to improper input validationCVE-2018-11776In KEVPublic exploitFix availableEPSS 100.0%8.1 High
- apache commons compress, oracle weblogic server +1 moreModerate severity vulnerability that affects org.apache.commons:commons-compressCVE-2018-11771Fix available5.5 Medium
- apache http servermod_userdir CRLF injectionCVE-2016-4975Fix availableEPSS 19.9%6.1 Medium
- apache sparkorg.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11 Improper Authentication vulnerabilityCVE-2018-11770Public exploitEPSS 66.1%4.2 Medium
- apache couchdbCouchDB administrative users before 2.2.0 can configure the database server via HTTP(S). Due to...CVE-2018-11769Fix available7.2 High
- Show moreLoading…