Skip to contentApache Software Foundation vulnerabilities
Products
Show 140 moreShow less
Newest
- apache cassandraApache Cassandra: Privilege escalation when enabling FQL/Audit logsCVE-2023-30601Fix available7.8 High
- apache jspwikiApache JSPWiki: XSS Injection points in several pluginsCVE-2022-46907Public exploitFix available6.1 Medium
- apache rocketmqApache RocketMQ: Possible remote code execution vulnerability when using the update configuration functionCVE-2023-33246In KEVPublic exploitFix availableEPSS 96.6%9.8 Critical
- apache inlongApache InLong: Privilege escalation vulnerability for InLongCVE-2023-31062Fix available9.8 Critical
- apache inlongApache InLong: Insecurity direct object references cancelling applicationsCVE-2023-31064Fix available7.5 High
- apache inlongApache InLong: Insufficient Session Expiration in InLongCVE-2023-31065Fix available9.1 Critical
- apache inlongApache InLong: Insecure direct object references for inlong sourcesCVE-2023-31066Fix available9.1 Critical
- apache inlongApache InLong: Weak Password Implementation in InLongCVE-2023-31098Fix available9.8 Critical
- apache inlongApache InLong: Users who joined later can see the data of deleted usersCVE-2023-31101Fix available6.5 Medium
- apache inlongApache InLong: Attackers can change the immutable name and type of clusterCVE-2023-31103Fix available7.5 High
- apache inlongApache InLong: Attackers can change the immutable name and type of nodesCVE-2023-31206Fix available7.5 High
- apache inlongApache InLong: IDOR make users can delete others' subscriptionCVE-2023-31453Fix available7.5 High
- apache inlongApache InLong: IDOR make users can bind any clusterCVE-2023-31454Fix available7.5 High
- apache inlongApache InLong: JDBC URL bypassing by adding blanksCVE-2023-31058Fix available7.5 High
- apache tomcat, debian linux, netapp 7-mode transition tool +2 moreApache Tomcat: Fix for CVE-2023-24998 is incompleteCVE-2023-28709Fix availableEPSS 48.0%7.5 High
- apache sling commons json, apache software foundation org.apache.sling.commons.json +1 moreMultiple parsing problems in the Apache Sling Commons JSON moduleCVE-2022-479379.8 Critical
- apache openmeetingsApache OpenMeetings: insufficient check of invitation hashCVE-2023-28936Fix available5.3 Medium
- apache openmeetingsApache OpenMeetings: allows bypass authenticationCVE-2023-29032Fix available8.1 High
- apache openmeetingsApache OpenMeetings: allows null-byte InjectionCVE-2023-29246Fix available7.2 High
- apache airflowApache Airflow: Privilege escalation using airflow logsCVE-2023-25754Fix available9.8 Critical
- apache airflowStored XSS on Apache AirflowCVE-2023-29247Fix available5.4 Medium
- apache brpcApache bRPC: ServerOptions.pid_file may cause arbitrary code executionCVE-2023-310399.8 Critical
- apache log4cxxApache Log4cxx: SQL injection when using ODBC appenderCVE-2023-31038Fix available8.8 High
- apache ranger, apache software foundation ranger hive plugin +1 morePermissions problem in the Apache Ranger Hive PluginCVE-2021-40331Fix available8.1 High
- apache rangerApache Ranger: code execution vulnerability in policy expressionsCVE-2022-45048Fix available8.4 High
- apache couchdb, apache software foundation ibm cloudant, ibm cloudant +2 moreApache CouchDB, IBM Cloudant: Information sharing via couchjs processesCVE-2023-26268Fix available4.4 Medium
- apache sparkApache Spark: Shell command injection via Spark UICVE-2023-32007Fix availableEPSS 75.8%8.8 High
- apache streampark, apache software foundation streampark (incubating) +1 moreApache StreamPark (incubating): Logic error causing any account resetCVE-2022-46365Fix available9.1 Critical
- apache streampark, apache software foundation streampark (incubating) +1 moreApache StreamPark (incubating): LDAP Injection VulnerabilityCVE-2022-45801Fix available5.4 Medium
- apache streampark, apache software foundation streampark (incubating) +1 moreApache StreamPark (incubating): Upload any file to any directoryCVE-2022-45802Fix available9.8 Critical
- apache jenaApache Jena: Exposure of arbitrary execution in script engine expressions.CVE-2023-22665Fix available5.4 Medium
- apache supersetApache Superset: Database connection password leakCVE-2023-30776Fix available4.9 Medium
- apache supersetApache Superset: Session validation vulnerability when using provided default SECRET_KEYCVE-2023-27524In KEVPublic exploitFix availableEPSS 98.1%8.9 High
- apache dolphinschedulerApache DolphinScheduler 3.0.0 to 3.1.1 python gateway has improper authenticationCVE-2023-25601Fix available4.3 Medium
- apache supersetApache Superset: Possible SSRF on import datasetsCVE-2023-25504Fix available4.9 Medium
- apache supersetApache Superset: Incorrect default permissions for Gamma roleCVE-2023-27525Fix available3.1 Low
- apache sparkApache Spark proxy-user privilege escalation from malicious configuration classCVE-2023-22946Fix available6.4 Medium
- apache iotdb, apache software foundation iotdb workbench, apache iotdb web workbench +2 moreApache IoTDB Workbench: apache/iotdb-web-workbench: forge the JWTToken to access workbenchCVE-2023-307719.8 Critical
- apache iotdbApache IoTDB grafana-connector Login Bypass VulnerabilityCVE-2023-24831Fix available9.8 Critical
- apache ofbizApache OFBiz: Arbitrary file reading vulnerabilityCVE-2022-47501EPSS 10.2%7.5 High
- apache sling engine, sling +1 moreApache Sling Engine: Include-based XSSCVE-2022-45064Fix available8.0 High
- apache inlongApache InLong: SQL injection in apache inLong 1.5.0CVE-2023-30465Fix available5.3 Medium
- apache linkisApache Linkis DatasourceManager module has a deserialization command executionCVE-2023-29216Fix available9.8 Critical
- apache linkisApache Linkis gateway module token authentication bypassCVE-2023-27987Fix available9.1 Critical
- apache linkisApache Linkis Mangaer module engineConn material upload exists Zip Slip issueCVE-2023-27603Fix available9.8 Critical
- apache linkisApache Linkis publicsercice module unrestricted upload of fileCVE-2023-27602Fix available9.8 Critical
- apache linkisApache Linkis JDBC EngineCon has a deserialization command executionCVE-2023-29215Fix available9.8 Critical
- apache software foundation airflow spark provider, apache apache-airflow-providers-apache-spark +1 moreApache Airflow Spark Provider Arbitrary File Read via JDBCCVE-2023-28710Fix available7.5 High
- apache airflow hive providerApache Airflow Hive Provider Beeline Remote Command ExecutionCVE-2023-28706Fix available9.8 Critical
- apache software foundation airflow drill provider, apache apache-airflow-providers-apache-drill +1 moreAirflow Apache Drill Provider Arbitrary File Read VulnerabilityCVE-2023-28707Fix available7.5 High
- Show moreLoading…