Skip to contentApache Software Foundation vulnerabilities
Products
Show 140 moreShow less
Newest
- apache james, james server +1 moreApache James server: Privilege escalation through unauthenticated JMXCVE-2023-26269Public exploitFix available7.8 High
- apache software foundation uima ducc, apache unstructured information management architecture +1 moreApache UIMA DUCC: DUCC (EOL) allows RCECVE-2023-289358.8 High
- apache archivaApache Archiva privilege escalationCVE-2023-28158Fix available6.5 Medium
- apache openmeetingsApache OpenMeetings: allows user impersonationCVE-2023-28326Fix available9.8 Critical
- apache fineractapache fineract: SQL injection vulnerability in certain procedure callsCVE-2023-251976.3 Medium
- apache fineractApache Fineract: SQL injection vulnerabilityCVE-2023-251964.3 Medium
- apache fineractApache Fineract: SSRF template type vulnerability in certain authenticated usersCVE-2023-251958.1 High
- apache inlongApache InLong: JDBC Deserialization Vulnerability in InLongCVE-2023-27296Fix available8.8 High
- apache openofficeApache OpenOffice: Macro URL arbitrary script executionCVE-2022-475027.8 High
- apache openofficeApache OpenOffice: Empty entry in Java class pathCVE-2022-38745Fix available7.8 High
- apache tomcatApache Tomcat: JSESSIONID Cookie missing secure attribute in some configurationsCVE-2023-28708Fix available4.3 Medium
- apache sling resource mergerApache Sling Resource Merger: Requests to certain paths managed by the Apache Sling Resource Merger can lead to DoSCVE-2023-26513Fix available7.5 High
- apache airflowInformation disclosure in Apache AirflowCVE-2023-25695Fix available5.3 Medium
- apache log4jApache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppenderCVE-2023-26464Fix available7.5 High
- apache dubboApache Dubbo Deserialization Vulnerability Gadgets BypassCVE-2023-23638Public exploitFix available5.0 Medium
- apache http server, unbit uwsgi, debian linux +2 moreApache HTTP Server: mod_proxy_uwsgi HTTP response splittingCVE-2023-27522Fix available7.5 High
- apache http serverApache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxyCVE-2023-25690Public exploitFix availableEPSS 84.0%9.8 Critical
- apache software foundation airflow aws provider, apache apache-airflow-providers-amazon +1 moreApache Airflow AWS Provider: Arbitrary file read via AWS providerCVE-2023-25956Fix available7.5 High
- apache software foundation airflow hive provider, apache apache-airflow-providers-apache-hive +1 moreApache Airflow Hive Provider Beeline RCECVE-2023-25696Fix available9.8 Critical
- apache software foundation airflow sqoop provider, apache apache-airflow-providers-apache-sqoop +1 moreSqoop Apache Airflow Provider Remote Code Execution VulnerabilityCVE-2023-25693Fix available9.8 Critical
- apache software foundation airflow google provider, apache apache-airflow-providers-google +1 moreApache Airflow Google Provider: Google Cloud Sql Provider Denial Of ServiceCVE-2023-25692Fix available7.5 High
- apache software foundation airflow google provider, apache apache-airflow-providers-google +1 moreApache Airflow Google Provider: Google Cloud Sql Provider Remote Command ExecutionCVE-2023-25691Fix available9.8 Critical
- apache software foundation sling, apache sling i18n +1 moreApache Sling does not allow to handle i18n content in a secure wayCVE-2023-25621Fix available6.5 Medium
- apache commons fileupload, apache software foundation tomcat, debian linux +2 moreApache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive partsCVE-2023-24998Public exploitFix availableEPSS 48.8%7.5 High
- apache kerby ldap backendLDAP Injection Vulnerability in Apache KerbyCVE-2023-25613Fix available9.8 Critical
- apache shenyuApache ShenYu Admin ultra viresCVE-2022-42735Fix available8.8 High
- apache sling jcr baseJNDI injection into Apache sling-org-apache-sling-jcr-baseCVE-2023-25141Fix available7.5 High
- apache nifiApache NiFi: Improper Restriction of XML External Entity References in ExtractCCDAAttributesCVE-2023-22832Fix available7.5 High
- apache kafka connect, apache software foundation kafka connect api +1 moreApache Kafka Connect API: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration using Kafka ConnectCVE-2023-25194Public exploitFix availableEPSS 95.8%8.8 High
- apache ageApache AGE: Python and Golang drivers allow data manipulation and exposure due to SQL injectionCVE-2022-45786Fix available8.1 High
- apache software foundation sling app cms, apache sling cms +1 moreApache Sling App CMS: XSS in CMS Reference / UI ComponentsCVE-2023-22849Fix available6.1 Medium
- apache inlongApache InLong: Jdbc Connection Security BypassCVE-2023-249979.8 Critical
- apache inlongApache InLong: Jdbc Connection causes arbitrary file reading in InLongCVE-2023-249777.5 High
- apache portable runtime (apr), portable runtime +1 moreApache Portable Runtime (APR): Windows out-of-bounds write in apr_socket_sendv functionCVE-2022-28331Fix available9.8 Critical
- apache portable runtime utility, apache software foundation portable runtime utility (apr-util) +1 moreApache Portable Runtime Utility (APR-util): out-of-bounds writes in the apr_base64 family of functionsCVE-2022-25147Fix available6.5 Medium
- apache portable runtime (apr), portable runtime +1 moreApache Portable Runtime (APR): out-of-bound writes in the apr_encode family of functionsCVE-2022-24963Fix available9.8 Critical
- apache linkis, apache software foundation linkis (incubating) +1 moreApache Linkis (incubating): The DatasourceManager module has a Local File Read VulnerabilityCVE-2022-44644Fix available6.5 Medium
- apache linkis, apache software foundation linkis (incubating) +1 moreApache Linkis (incubating): The DatasourceManager module has a serialization attack vulnerabilityCVE-2022-44645Fix available8.8 High
- apache iotdb, apache software foundation iotdb workbench +1 moreApache IoTDB Workbench: apache/iotdb-web-workbench: forge the JWTToken to access workbenchCVE-2023-24829Fix available8.8 High
- apache iotdb, apache software foundation iotdb workbench +1 moreApache IoTDB Workbench: apache/iotdb-web-workbench: create a user without authorizationCVE-2023-24830Fix available7.5 High
- apache airflow, apache software foundation airflow mysql provider, apache apache-airflow-providers-mysql +2 moreApache Airflow, Apache Airflow MySQL Provider: Arbitrary file read via MySQL provider in Apache AirflowCVE-2023-22884Public exploitFix availableEPSS 11.9%9.8 Critical
- apache http serverApache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splittingCVE-2022-37436Fix availableEPSS 52.7%5.3 Medium
- apache http serverApache HTTP Server: mod_proxy_ajp Possible request smugglingCVE-2022-36760Fix available9.0 Critical
- apache http serverApache HTTP Server: mod_dav out of bounds read, or write of zero byteCVE-2006-20001Public exploitFix available7.5 High
- apache supersetApache Superset: SQL injection vulnerability in adhoc clausesCVE-2022-41703Fix available5.4 Medium
- apache supersetApache Superset: Dashboard metadata information leakCVE-2022-45438Fix available5.3 Medium
- apache supersetApache Superset: Open Redirect VulnerabilityCVE-2022-43721Fix available5.4 Medium
- apache supersetApache Superset: Improper rendering of user inputCVE-2022-43720Fix available5.4 Medium
- apache supersetApache Superset: Cross Site Request Forgery (CSRF) on accept, request access APICVE-2022-43719Fix available8.8 High
- apache supersetApache Superset: Cross-Site Scripting vulnerability on upload formsCVE-2022-43718Fix available5.4 Medium
- Show moreLoading…