Skip to contentApache Software Foundation vulnerabilities
Products
Show 140 moreShow less
Newest
- apache shardingsphere elasticjob-uiAccess-Token in ElasticJob UI causes password disclosureCVE-2022-22733Public exploitEPSS 41.8%6.5 Medium
- apache airflowApache Airflow: Creating DagRuns didn't respect Dag-level permissions in the WebserverCVE-2021-45230Fix available6.5 Medium
- apache chainsaw, log4j, apache software foundation log4j 1.x +24 more +26 moreA deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.CVE-2022-23307Fix availableEPSS 54.4%8.8 High
- apache log4j, apache software foundation log4j 1.x, broadcom brocade sannav +26 more +28 moreSQL injection in JDBC Appender in Apache Log4j V1CVE-2022-23305Public exploitFix availableEPSS 66.5%9.8 Critical
- apache log4j, apache software foundation log4j 1.x, broadcom brocade sannav +24 more +26 moreDeserialization of untrusted data in JMSSink in Apache Log4j 1.xCVE-2022-23302Fix availableEPSS 63.8%8.8 High
- apache knoxDOM based XSS Vulnerability in Apache KnoxCVE-2021-42357Fix available6.1 Medium
- apache guacamoleImproper validation of SAML responsesCVE-2021-439998.8 High
- apache guacamolePrivate tunnel identifier may be included in the non-private details of active connectionsCVE-2021-41767Fix available6.5 Medium
- apache dubboDubbo Hessian cause RCE when parse errorCVE-2021-43297Public exploitFix availableEPSS 17.4%9.8 Critical
- apache avroPossible DOS vulnerabilities in C# Avro SDKCVE-2021-43045Fix available7.5 High
- apache kylinHardcoded credentialsCVE-2021-45458Fix available7.5 High
- apache kylinOverly broad CORS configurationCVE-2021-45457Fix available7.5 High
- apache kylinCommand injectionCVE-2021-45456Fix availableEPSS 88.9%9.8 Critical
- apache kylinMysql JDBC Connector Deserialize RCECVE-2021-36774Fix available6.5 Medium
- apache kylinApache Kylin unsafe class loadingCVE-2021-31522Fix available9.8 Critical
- apache kylinImproper Access Control to Streaming Coordinator & SSRFCVE-2021-27738Fix available7.5 High
- apache pluto, apache software foundation portals +1 moreXSS vulnerability in the MVCBean JSP portlet maven archetypeCVE-2021-36739Fix available6.1 Medium
- apache pluto, apache software foundation portals +1 moreXSS vulnerability in the JSP version of the Apache Pluto Applicant MVCBean CDI portletCVE-2021-36738Fix available6.1 Medium
- apache pluto, apache software foundation portals +1 moreXSS in V3 Demo PortletCVE-2021-36737Fix available6.1 Medium
- apache jamesSieve file storage vulnerable to path traversal attacksCVE-2021-40525Fix available9.1 Critical
- apache jamesApache James IMAP parsing Denial Of ServiceCVE-2021-40111Fix available6.5 Medium
- apache jamesApache James IMAP vulnerable to a ReDoSCVE-2021-40110Fix available7.5 High
- apache jamesApache James vulnerable to STARTTLS command injection (IMAP and POP3)CVE-2021-38542Fix available5.9 Medium
- apache geodeApache Geode project log file redaction of sensitive information vulnerabilityCVE-2021-34797Fix available7.5 High
- apache log4j, apache software foundation log4j2, cisco cloudcenter +20 more +22 moreApache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configurationCVE-2021-44832Public exploitFix availableEPSS 97.9%6.6 Medium
- apache apisix dashboardsecurity vulnerability on unauthorized access.CVE-2021-45232Public exploitFix availableEPSS 86.3%9.8 Critical
- apache solrApache Solr information disclosure vulnerability through DataImportHandlerCVE-2021-44548Fix available9.8 Critical
- apache http server, apple mac os x, macos +8 more +10 morePossible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlierCVE-2021-44224Fix availableEPSS 82.3%8.2 High
- apache software foundation parquet, apache parquet java +1 moreApache Parquet-MR potential DoS in case of malicious Parquet fileCVE-2021-41561Fix available7.5 High
- apache http server, apple mac os x, macos +10 more +12 morePossible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlierCVE-2021-44790Public exploitFix availableEPSS 96.8%9.8 Critical
- apache plc4xApache PLC4X 0.9.0 Buffer overflow in PLC4C via crafted server responseCVE-2021-430838.8 High
- apache log4j, apache software foundation log4j2, debian linux +114 more +116 moreApache Log4j2 does not always protect from infinite recursion in lookup evaluationCVE-2021-45105Public exploitFix availableEPSS 100.0%5.9 Medium
- apache nifiApache NiFi information disclosure by XXECVE-2021-44145Fix available6.5 Medium
- apache log4j, log4j2, cvat computer vision annotation tool +53 more +55 moreApache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attackCVE-2021-45046In KEVPublic exploitFix availableEPSS 100.0%9.0 Critical
- apache sling commons messaging mailSMTPS server hostname not checked when making TLS connection to SMTPS serverCVE-2021-44549Fix available7.4 High
- apache log4j, apache software foundation log4j 1.x, fedoraproject fedora +44 more +46 moreDeserialization of untrusted data in JMSAppender in Apache Log4j 1.2CVE-2021-4104Public exploitFix availableEPSS 80.6%7.5 High
- apache log4j, log4j2, apple xcode +141 more +143 moreApache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpointsCVE-2021-44228In KEVPublic exploitFix availableEPSS 100.0%10.0 Critical
- apache airavata django portalairavata-django-portal allows CRLF log injection because of the lack of escaping in the log statementsCVE-2021-434105.3 Medium
- apache jspwikiArbitrary file deletion on logoutCVE-2021-44140Fix available9.1 Critical
- apache jspwikiXSS vulnerability on Denounce pluginCVE-2021-40369Fix available6.1 Medium
- apache apisixPath traversal in request_uri variableCVE-2021-43557Public exploitFix availableEPSS 13.0%7.5 High
- apache ozoneUnauthenticated access to Ozone Recon HTTP endpointsCVE-2021-41532Fix available5.3 Medium
- apache ozoneOwners of the S3 tokens are not validatedCVE-2021-39236Fix available8.8 High
- apache ozoneAccess mode of block tokens are not enforcedCVE-2021-39235Fix available6.5 Medium
- apache ozoneRaw block data can be read bypassing ACL/authorizationCVE-2021-39234Fix available6.8 Medium
- apache ozoneContainer-related datanode operations can be called without authorizationCVE-2021-39233Fix available9.1 Critical
- apache ozoneMissing admin check for SCM related admin commandsCVE-2021-39232Fix available8.8 High
- apache ozoneMissing authentication/authorization on internal RPC endpointsCVE-2021-39231Fix available9.1 Critical
- apache ozoneOriginal block tokens are persisted and can be retrievedCVE-2021-36372Fix available9.8 Critical
- apache supersetPossible log injectionCVE-2021-42250Fix available6.5 Medium
- Show moreLoading…