Skip to contentApache Software Foundation vulnerabilities
Products
Show 140 moreShow less
Newest
- apache dolphinschedulerApache DolphinScheduler prior to 3.0.0 allows path traversalCVE-2022-34662Public exploitFix available6.5 Medium
- apache sparkApache Spark XSS vulnerability in log viewer UI JavascriptCVE-2022-31777Fix available5.4 Medium
- apache dolphinschedulerApache DolphinScheduler exposes files without authenticationCVE-2022-26884Public exploitFix available6.5 Medium
- apache iotdbApache IoTDB prior to 0.13.3 allows DoSCVE-2022-43766Fix available7.5 High
- apache flumeApache Flume prior to 1.11.0 has an Improper Input Validation (JNDI Injection) in JMSSourceCVE-2022-42468Fix available9.8 Critical
- apache linkisThe Apache Linkis JDBC EngineConn module has a RCE VulnerabilityCVE-2022-39944Fix available8.8 High
- apache batik, apache software foundation xml graphics, debian linux +2 moreApache Batik prior to 1.16 allows RCE via scriptingCVE-2022-42890Fix available7.5 High
- apache batik, apache software foundation xml graphics, debian linux +2 moreApache Batik prior to 1.16 allows RCE when loading untrusted SVG inputCVE-2022-41704Fix available7.5 High
- apache geodeApache Geode stored Cross-Site Scripting (XSS) via data injection vulnerability in Pulse web applicationCVE-2022-34870Fix available5.4 Medium
- apache heron, apache software foundation heron (incubating) +1 moreCRLF log injectionCVE-2021-42010Fix available9.8 Critical
- apache isish2 webconsole (available only in prototype mode) should nevertheless be disabled by default.CVE-2022-42467Fix available5.3 Medium
- apache isisXSS vulnerability, eg for String properties.CVE-2022-42466Fix available6.1 Medium
- apache dubboApache Dubbo Hession Deserialization Vulnerability Gadgets BypassCVE-2022-39198Fix available9.8 Critical
- apache commons text, juniper security threat response manager, netapp bluexp +2 moreApache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaultsCVE-2022-42889Public exploitFix availableEPSS 99.9%9.8 Critical
- apache kylinApache Kylin prior to 4.0.2 allows command injection when the configuration overwrites function overwrites system parametersCVE-2022-24697Fix availableEPSS 84.8%9.8 Critical
- apache shiroAuthentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcherCVE-2022-40664Fix available9.8 Critical
- apache airflowSession still functional after user is deactivatedCVE-2022-41672Fix available8.1 High
- apache tomcat, debian linux +1 moreApache Tomcat: Information disclosureCVE-2021-43980Fix available3.7 Low
- apache pulsarDisabled Certificate Validation makes Broker, Proxy Admin Clients vulnerable to MITM attackCVE-2022-33683Fix available5.9 Medium
- apache pulsarDisabled Hostname Verification makes Brokers, Proxies vulnerable to MITM attackCVE-2022-33682Fix available5.9 Medium
- apache pulsarImproper Hostname Verification in Java Client and Proxy can expose authentication data via MITMCVE-2022-33681Fix available5.9 Medium
- apache pulsarApache Pulsar Proxy target broker address isn't validatedCVE-2022-24280Fix available6.5 Medium
- apache pinotPinot query endpoint and the realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function supportCVE-2022-26112Fix available9.8 Critical
- apache soapApache SOAP: XML External Entity Injection (XXE) allows unauthenticated users to read arbitrary files via HTTPCVE-2022-407057.5 High
- apache batik, apache software foundation xml graphics, debian linux +2 moreJar url should be blocked by DefaultScriptSecurityCVE-2022-40146Public exploitFix available7.5 High
- apache batik, apache software foundation xml graphics, debian linux +2 morePDFTranscoder does not block external resourcesCVE-2022-38648Fix available5.3 Medium
- apache batik, apache software foundation xml graphics, debian linux +2 moreServer-Side Request Forgery Information Disclosure VulnerabilityCVE-2022-38398Fix available5.3 Medium
- apache airflowOpen RedirectCVE-2022-40754Fix available6.1 Medium
- apache airflowFormat String VulnerabilityCVE-2022-40604Fix available7.5 High
- apache inlongDeserialization attack in Apache InLong prior to version 1.3.0 allows RCE via JDBCCVE-2022-40955Fix available8.8 High
- apache kafkaUnauthenticated clients may cause OutOfMemoryError on Apache Kafka BrokersCVE-2022-34917Fix available7.5 High
- apache calciteApache Calcite: potential XEE attacksCVE-2022-39135Fix available9.8 Critical
- apache jamesSTARTTLS command injection in Apache JAMESCVE-2022-28220Fix available7.5 High
- apache iotdbNo authorization of DatabaseConnectController in grafana-connector.CVE-2022-38370Fix available7.5 High
- apache iotdbLogin check vulnerability by session IdCVE-2022-38369Fix available8.8 High
- apache airflowOverly permissive umask for daemonsCVE-2022-38170Fix available4.7 Medium
- apache airflowSession FixationCVE-2022-38054Fix available9.8 Critical
- apache ofbizRegular Expression Denial of Service (ReDoS) vulnerability in Apache OFBizCVE-2022-291587.5 High
- apache ofbizJava Deserialization via RMI Connection from the Solr plugin of Apache OFBizCVE-2022-29063Public exploit9.8 Critical
- apache ofbizServer-Side Template Injection affecting the ecommerce plugin of Apache OFBizCVE-2022-25813Public exploitEPSS 67.3%7.5 High
- apache ofbizUnauth Path Traversal with file corruption affecting the Birt plugin of Apache OFBizCVE-2022-253719.8 Critical
- apache ofbizUnauth Stored XSS vulnerability in the Birt plugin of Apache OFBizCVE-2022-253705.4 Medium
- apache shenyuApache ShenYu Admin Improper Privilege ManagementCVE-2022-37435Fix available8.8 High
- apache geodeApache Geode deserialization of untrusted data flaw when using REST API on Java 8 or Java 11CVE-2022-37023Fix available6.5 Medium
- apache geodeApache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 11CVE-2022-37022Fix available8.8 High
- apache geodeApache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 8.CVE-2022-37021Fix available9.8 Critical
- apache libapreq2, debian linux, fedoraproject fedora +2 morelibapreq2 multipart form parse memory corruptionCVE-2022-22728Fix available7.5 High
- apache hadoopApache Hadoop YARN remote code execution in ZKConfigurationStore of capacity schedulerCVE-2021-25642Public exploitFix available8.8 High
- apache artemis, apache software foundation activemq artemis, netapp active iq unified manager +1 more +3 moreHTML Injection in ActiveMQ Artemis Web ConsoleCVE-2022-35278Fix available6.1 Medium
- apache flumeImproper Input Validation (JNDI Injection) in JMSMessageConsumerCVE-2022-34916Fix available9.8 Critical
- Show moreLoading…