Skip to contentApache Software Foundation vulnerabilities
Products
Show 140 moreShow less
Newest
- apache supersetApache Superset: Cross-Site Scripting on dashboardsCVE-2022-43717Fix available5.4 Medium
- apache shiro, vmware spring boot +1 moreApache Shiro before 1.11.0, when used with Spring Boot 2.6+, may allow authentication bypass through a specially crafted HTTP requestCVE-2023-22602Fix available7.5 High
- apache software foundation sling app cms, apache sling cms +1 moreApache Sling App CMS: XSS in CMS Site Group DetailCVE-2022-46769Fix available5.4 Medium
- apache james, apache software foundation james server +1 moreApache James server: Temporary File Information DisclosureCVE-2022-459355.5 Medium
- apache james, apache software foundation james mime4j +1 moreApache James MIME4J: Temporary File Information Disclosure in MIME4J TempFileStorageProviderCVE-2022-45787Fix available5.5 Medium
- apache dolphinschedulerApache DolphinScheduler: Remote command execution Vulnerability in script alert pluginCVE-2022-45875Fix available9.8 Critical
- apache tomcatApache Tomcat: JsonErrorReportValve escapingCVE-2022-45143Fix available7.5 High
- apache kylinApache Kylin: Command injection by Diagnosis ControllerCVE-2022-44621Fix available9.8 Critical
- apache kylinApache Kylin: Command injection by Useless configurationCVE-2022-43396Fix availableEPSS 55.3%8.8 High
- apache shardingsphere, apache software foundation shardingsphere-proxy +1 moreApache ShardingSphere-Proxy: MySQL authentication bypassCVE-2022-45347Fix available9.8 Critical
- apache karafApache Karaf: JDBC JAAS LDAP injectionCVE-2022-40145Fix available9.8 Critical
- apache software foundation airflow hive provider, apache apache-airflow-providers-apache-hive +1 moreApache Airflow Hive Provider: Hive Provider RCE vulnerability with hive_cli_paramsCVE-2022-46421Fix available9.8 Critical
- apache traffic serverApache Traffic Server: Security issues with the xdebug pluginCVE-2022-40743Fix available6.1 Medium
- apache traffic serverApache Traffic Server: Improperly reading the client requestsCVE-2022-37392Fix available5.3 Medium
- apache traffic serverApache Traffic Server: Improperly handled requests can cause crashes in specific pluginsCVE-2022-32749Fix available7.5 High
- apache helixApache Helix: Open redirectCVE-2022-47500Fix available6.1 Medium
- apache zeppelinApache Zeppelin: Stored XSS in note permissionsCVE-2022-46870Fix available5.4 Medium
- apache zeppelinApache Zeppelin: Arbitrary file deletion vulnerabilityCVE-2021-28655Fix available6.5 Medium
- apache bookkeeperApache BookKeeper: Java Client Uses Connection to Host that Failed Hostname VerificationCVE-2022-32531Fix available5.9 Medium
- apache atlasApache Atlas: zip path traversal in import functionalityCVE-2022-34271Fix available8.8 High
- apache cxfApache CXF SSRF VulnerabilityCVE-2022-46364Public exploitFix available9.8 Critical
- apache cxfApache CXF directory listing / code exfiltrationCVE-2022-46363Fix available7.5 High
- apache manifoldcfApache ManifoldCF: LDAP Injection Vulnerability - ActiveDirectory AuthoritiesCVE-2022-459105.3 Medium
- apache commons net, debian linux +1 moreApache Commons Net's FTP client trusts the host from PASV response by defaultCVE-2021-37533Fix available6.5 Medium
- apache tapestryApache Tapestry prior to version 4 (EOL) allows RCE though deserialization of untrusted inputCVE-2022-46366Fix available9.8 Critical
- apache fineractApache Fineract allowed an authenticated user to perform remote code execution due to path traversalCVE-2022-44635EPSS 68.8%8.8 High
- apache dolphinschedulerApache DolphinScheduler config file read by task riskCVE-2022-26885Fix available7.5 High
- apache dolphinschedulerApache DolphinScheduler prior to 2.0.5 have command execution vulnerabilityCVE-2022-45462Fix available9.8 Critical
- apache airflow, apache software foundation airflow hive provider, apache apache-airflow-providers-apache-hive +2 moreApache Airflow Hive Provider vulnerability (command injection via hive_cli connection)CVE-2022-41131Fix available7.8 High
- apache airflow, apache software foundation airflow spark provider, apache apache-airflow-providers-apache-spark +2 moreApache Airflow Spark Provider RCE that bypass restrictions to read arbitrary filesCVE-2022-40954Fix available5.5 Medium
- apache airflow, apache software foundation airlfow pig provider, apache apache-airflow-providers-apache-pig +2 moreApache Airlfow Pig Provider RCECVE-2022-40189Fix available9.8 Critical
- apache airflow, apache software foundation airflow pinot provider, apache apache-airflow-providers-apache-pinot +2 moreApache Airflow Pinot provider allowed Command InjectionCVE-2022-38649Fix available9.8 Critical
- apache hamaApache Hama allows XSS and information disclosureCVE-2022-454707.5 High
- apache sshd, apache software foundation mina sshd +1 moreApache MINA SSHD: Java unsafe deserialization vulnerabilityCVE-2022-45047Public exploitFix available9.8 Critical
- apache airflowApache Airflow: Open redirect during loginCVE-2022-45402Fix availableEPSS 81.1%6.1 Medium
- apache archivaApache Archiva prior to 2.2.9 allows an authenticated user to delete arbitrary directoriesCVE-2022-40309Fix available4.3 Medium
- apache archivaApache Archiva prior to 2.2.9 may allow the anonymous user to read arbitrary filesCVE-2022-40308Fix available7.5 High
- apache soapApache SOAP allows unauthenticated users to potentially invoke arbitrary codeCVE-2022-453789.8 Critical
- apache jena sdbApache Jena SDB allows arbitrary deserialisation via JDBCCVE-2022-45136Fix available9.8 Critical
- apache airflowApache Airflow <2.4.0 has an RCE in a bash exampleCVE-2022-40127Public exploitFix availableEPSS 85.7%8.8 High
- apache airflowApache Airflow prior to 2.3.1 may include sensitive values in rendered templateCVE-2022-27949Fix available7.5 High
- apache commons bcel, fedoraproject fedora +1 moreApache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writingCVE-2022-42920Fix available9.8 Critical
- apache ivyApache Ivy allows path traversal in the presence of a malicious repositoryCVE-2022-37866Fix available7.5 High
- apache ivyApache Ivy allows creating/overwriting any file on the systemCVE-2022-37865Fix available9.1 Critical
- apache pulsarApache Pulsar C++/Python OAuth Clients prior to 3.0.0 were vulnerable to an MITM attack due to Disabled Certificate ValidationCVE-2022-33684Fix available8.1 High
- apache software foundation uima, apache uimaj +1 moreApache UIMA prior to 3.3.1 has a path traversal vulnerability when extracting (PEAR) archivesCVE-2022-32287Public exploitFix available7.5 High
- apache airflowApache Airflow prior to 2.4.2 has an open redirectCVE-2022-43985Fix available6.1 Medium
- apache airflowApache Airflow prior to 2.4.2 allows reflected XSS via Origin Query Argument in URLCVE-2022-43982Fix available6.1 Medium
- apache sling cms, apache software foundation sling app cms +1 moreXSS in Sling CMS Reference App Taxonomy PathCVE-2022-43670Fix available5.4 Medium
- apache tomcatApache Tomcat request smuggling via malformed content-lengthCVE-2022-42252Fix available7.5 High
- Show moreLoading…