Skip to contentApache Software Foundation vulnerabilities
Products
Show 140 moreShow less
Newest
- apache traffic serverApache Traffic Server: Differential fuzzing for HTTP request parsing discrepanciesCVE-2023-33934Fix available9.1 Critical
- apache traffic serverApache Traffic Server: Invalid Range header causes a crashCVE-2022-47185Fix available7.5 High
- apache rollerApache Roller: Roller's weblog category, weblog settings and file-upload features did not properly sanitize input could be exploited to perform Reflected Cross Site Scripting (XSS) even on a Roller si…CVE-2023-375815.4 Medium
- apache airflowApache Airflow: Airflow "Run task" feature allows execution with unnecessary priviledgesCVE-2023-39508Fix available8.8 High
- apache nifiApache NiFi: Potential Code Injection with Properties Referencing Remote ResourcesCVE-2023-36542Public exploitFix available8.8 High
- apache helixApache Helix: Deserialization vulnerability in Helix workflow and RESTCVE-2023-38647Fix available9.8 Critical
- apache software foundation felix healthcheck webconsole plugin, apache felix health check webconsole plugin +1 moreApache Felix Healthcheck Webconsole Plugin: XSS in healthcheck webconsole pluginCVE-2023-38435Fix available6.1 Medium
- apache jackrabbit, apache software foundation jackrabbit standalone (jackrabbit-standalone and jackrabbit-standalone-components), jackrabbit webapp (jackrabbit-webapp) +2 moreApache Jackrabbit RMI access can lead to RCECVE-2023-37895Fix available9.8 Critical
- apache inlongApache InLong: SQL injection in audit endpointCVE-2023-35088Fix available9.8 Critical
- apache inlongApache InLong: JDBC URL bypassing by allowLoadLocalInfileInPath paramCVE-2023-34434Fix available7.5 High
- apache inlongApache InLong: General user can delete and update processCVE-2023-34189Fix available6.5 Medium
- apache shiroApache Shiro before 1.12.0, or 2.0.0-alpha-3, may be susceptible to a path traversal attack when used together with APIs or other web frameworks that route requests based on non-normalized requests.CVE-2023-34478Public exploitFix available9.8 Critical
- apache shardingsphere, apache software foundation shardingsphere-agent +1 moreShardingSphere-Agent: Deserialization vulnerability in ShardingSphere AgentCVE-2023-28754Fix available8.8 High
- apache eventmesh, eventmesh-connector-rabbitmq, apache software foundation eventmesh (incubating) rabbitmq connector +2 moreApache EventMesh RabbitMQ-Connector plugin allows RCE through deserialization of untrusted dataCVE-2023-265129.8 Critical
- apache software foundation airflow apache hive provider, apache apache-airflow-providers-apache-hive +1 moreApache Airflow Apache Hive Provider: Improper Input Validation in Hive Provider with proxy_userCVE-2023-37415Fix available8.8 High
- apache ambariApache Ambari: Allows authenticated metrics consumers to perform RCECVE-2022-45855Fix available8.0 High
- apache ambariApache Ambari: A malicious authenticated user can remotely execute arbitrary code in the context of the application.CVE-2022-42009Fix available8.0 High
- apache rocketmqApache RocketMQ: Possible remote code execution when using the update configuration functionCVE-2023-37582Public exploitFix availableEPSS 90.4%9.8 Critical
- apache airflowApache Airflow: Scheduler remote DoSCVE-2023-22888Fix available6.5 Medium
- apache airflowApache Airflow: ReDoS via dags functionCVE-2023-36543Fix available6.5 Medium
- apache airflowApache Airflow: Security vulnerability on AirFlow ConnectionsCVE-2022-46651Fix available6.5 Medium
- apache airflowApache Airflow path traversal by authenticated userCVE-2023-22887Fix available6.5 Medium
- apache airflowApache Airflow: Access to DAGs without relevant permissionCVE-2023-35908Fix available6.5 Medium
- apache pulsar, apache software foundation pulsar broker +1 moreApache Pulsar Broker: Incorrect Authorization Validation for Rest ProducerCVE-2023-30428Fix available8.2 High
- apache pulsarApache Pulsar: Incorrect Authorization for Function Worker when using mTLS Authentication through Pulsar ProxyCVE-2023-30429Fix available9.6 Critical
- apache pulsarApache Pulsar: Broker does not always disconnect client when authentication data expiresCVE-2023-31007Fix available0.0 None
- apache pulsar, apache software foundation pulsar function worker +1 moreApache Pulsar Function Worker: Incorrect Authorization for Function Worker Can Leak Sink/Source CredentialsCVE-2023-37579Fix available8.2 High
- apache jenaApache Jena: Exposure of execution in script engine expressions.CVE-2023-32200Fix available8.8 High
- apache camel, apache software foundation camel jira +1 moreApache Camel JIRA: Temporary file information disclosure in Camel-JiraCVE-2023-34442Fix available3.3 Low
- apache sshd, apache software foundation mina sshd +1 moreApache MINA SSHD: Information disclosure bugs with RootedFilesystemCVE-2023-35887Public exploitFix available5.0 Medium
- apache johnzonApache Johnzon: Prevent inefficient internal conversion from BigDecimal at large scaleCVE-2023-33008Fix available5.3 Medium
- apache any23Apache Any23: Possible excessive allocation of resources reading input.CVE-2023-341506.5 Medium
- apache software foundation airflow apache hive provider, apache apache-airflow-providers-apache-hive +1 moreApache Airflow Hive Provider Beeline RCE with PrincipalCVE-2023-35797Fix available9.8 Critical
- apache software foundation airflow jdbc provider, apache apache-airflow-providers-jdbc +1 moreApache Airflow JDBC Provider: RCE VulnerabilityCVE-2023-22886Fix available8.8 High
- apache software foundation airflow mssql provider, airflow odbc provider, apache apache-airflow-providers-microsoft-mssql +1 more +3 moreAirflow Apache ODBC and MSSQL Providers Arbitrary File Read VulnerabilityCVE-2023-35798Fix available4.3 Medium
- apache software foundation airflow odbc provider, apache apache-airflow-providers-odbc +1 moreApache Airflow ODBC Provider: Remote code execution vulnerabilityCVE-2023-34395Fix available7.8 High
- apache streampipesApache StreamPipes: Privilege escalation through non-admin userCVE-2023-31469Fix available8.8 High
- apache tomcatApache Tomcat: AJP response header mix-upCVE-2023-34981Fix available7.5 High
- apache accumuloApache Accumulo: Accumulo 2.1.0 may incorrectly validate cached credentialsCVE-2023-34340Fix available9.8 Critical
- apache airflowApache Airflow: Information disclosure on configuration viewCVE-2023-35005Fix available6.5 Medium
- apache strutsApache Struts: DoS via OOM owing to no sanity limit on normal form fields in multipart formsCVE-2023-34396Fix available4.3 Medium
- apache strutsApache Struts: DoS via OOM owing to not properly checking of list boundsCVE-2023-34149Fix available4.3 Medium
- apache traffic server, debian linux, fedoraproject fedora +2 moreApache Traffic Server: Configuration option to block the PUSH method in ATS didn't workCVE-2023-30631Fix available7.5 High
- apache traffic serverApache Traffic Server: s3_auth plugin problem with hash calculationCVE-2023-33933Fix available7.5 High
- apache traffic server, debian linux +1 moreApache Traffic Server: The TRACE method can be use to disclose network informationCVE-2022-47184Fix available7.5 High
- apache nifiApache NiFi: Potential Deserialization of Untrusted Data with JNDI in JMS ComponentsCVE-2023-34212Public exploitFix available6.5 Medium
- apache nifiApache NiFi: Potential Code Injection with Database Services using H2CVE-2023-34468Public exploitFix availableEPSS 61.9%8.8 High
- apache guacamoleApache Guacamole: Use-after-free in handling of RDP audio input bufferCVE-2023-30576Fix available6.8 Medium
- apache guacamoleApache Guacamole: Incorrect calculation of Guacamole protocol element lengthsCVE-2023-30575Fix available6.5 Medium
- apache airflow cncf kubernetes, apache software foundation airflow cncf kubernetes provider, apache apache-airflow-providers-cncf-kubernetes +2 moreApache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configurationCVE-2023-33234Fix available7.2 High
- Show moreLoading…