Skip to contentApache Software Foundation vulnerabilities
Products
Show 140 moreShow less
Newest
- apache airflowApache Airflow: Sensitive parameters exposed in API when "non-sensitive-only" configuration is setCVE-2023-46288Fix available4.3 Medium
- apache http serverApache HTTP Server: DoS in HTTP/2 with initial windows size 0CVE-2023-43622Public exploitFix availableEPSS 68.8%7.5 High
- apache http server, debian linux, fedoraproject fedora +2 moreApache HTTP Server: mod_macro buffer over-readCVE-2023-31122Fix available7.5 High
- apache software foundation santuario, apache santuario xml security for java +1 moreApache Santuario: Private Key disclosure in debug-log outputCVE-2023-44483Fix available6.5 Medium
- apache http server, debian linux, fedoraproject fedora +2 moreApache HTTP Server: HTTP/2 stream memory not reclaimed right away on RSTCVE-2023-45802Public exploitFix available5.9 Medium
- apache inlongApache inlong has an Arbitrary File Read VulnerabilityCVE-2023-46227Fix available7.5 High
- apache shenyuServer-Side Request Forgery in Apache ShenYuCVE-2023-25753Fix available6.5 Medium
- apache traffic server, fedoraproject fedora +1 moreApache Traffic Server: Malformed http/2 frames can cause an abortCVE-2023-39456Fix availableEPSS 58.3%7.5 High
- apache traffic server, fedoraproject fedora +1 moreApache Traffic Server: s3_auth plugin problem with hash calculationCVE-2023-41752Fix available7.5 High
- apache inlongApache InLong: General user Unauthorized access User ManagementCVE-2023-43666Fix available6.5 Medium
- apache inlongApache InLong: Log Injection in Global functionsCVE-2023-43667Fix available7.5 High
- apache inlongApache InLong: Jdbc Connection Security Bypass in InLongCVE-2023-43668Fix available9.8 Critical
- apache brpcApache bRPC: The builtin service rpcz page has an XSS attack vulnerabilityCVE-2023-457576.1 Medium
- apache airflowApache Airflow: Bypass permission verification to view task instances of other dagsCVE-2023-42663Fix available6.5 Medium
- apache airflowApache Airflow: Improper access control to DAG resourcesCVE-2023-42792Fix available6.5 Medium
- apache airflowApache Airflow: Configuration information leakage vulnerabilityCVE-2023-45348Fix available4.3 Medium
- apache airflowApache Airflow: Improper access control vulnerability in the "List dag warnings" featureCVE-2023-42780Fix available6.5 Medium
- apache zookeeper, debian linux +1 moreApache ZooKeeper: Authorization bypass in SASL Quorum Peer AuthenticationCVE-2023-44981Fix available9.1 Critical
- apache tomcatApache Tomcat: FileUpload: DoS due to accumulation of temporary files on WindowsCVE-2023-42794Fix available5.9 Medium
- apache tomcat, debian linux +1 moreApache Tomcat: Trailer header parsing too lenientCVE-2023-45648Fix available5.3 Medium
- apache tomcat, accumulo, debian linux +2 moreApache Tomcat: Failure during request clean-up leads to sensitive data leaking to subsequent requestsCVE-2023-42795Fix available5.3 Medium
- apache avro, apache software foundation avro java sdk +1 moreApache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDKCVE-2023-39410Fix available7.5 High
- apache flink stateful functionsApache Flink Stateful Functions allowed HTTP header injection due to Improper Neutralization of CRLF SequencesCVE-2023-418346.1 Medium
- apache airflow hdfs providerApache HDFS Provider error message suggested installation of incorrect pip packageCVE-2023-41267Fix available7.8 High
- apache commons compressApache Commons Compress: Denial of service via CPU consumption for malformed TAR fileCVE-2023-42503Fix available5.5 Medium
- apache tomcat connectorsApache Tomcat Connectors: Unexpected use of first declared worker in mod_jk for unmapped requestCVE-2023-41081Fix available7.5 High
- apache airflowApache Airflow: Secrets can be unmasked in the "Rendered Template"CVE-2023-40712Fix available6.5 Medium
- apache airflowApache Airflow Dag Runs Broken Access Control VulnerabilityCVE-2023-40611Fix available4.3 Medium
- apache supersetApache Superset: SQL parser edge case bypasses data access authorizationCVE-2023-32672Fix available4.3 Medium
- apache supersetApache Superset: Metadata db write access can lead to remote code executionCVE-2023-37941Public exploitFix availableEPSS 35.5%6.6 Medium
- apache supersetApache Superset: Possible Unauthorized Registration of SQLite Database ConnectionsCVE-2023-39265Public exploitFix availableEPSS 86.0%3.8 Low
- apache supersetApache Superset: Stack traces enabled by defaultCVE-2023-39264Fix available4.3 Medium
- apache supersetApache Superset: Improper data permission validation on Jinja templated queriesCVE-2023-27523Fix available5.0 Medium
- apache supersetApache Superset: Improper API permission for low privilege users allows for SSRFCVE-2023-36388Fix available4.3 Medium
- apache supersetApache Superset: Improper Authorization check on import chartsCVE-2023-27526Fix available4.3 Medium
- apache supersetApache Superset: Improper API permission for low privilege usersCVE-2023-36387Fix available5.4 Medium
- apache axisApache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getServiceCVE-2023-40743Fix available9.8 Critical
- apache software foundation nifi minifi c++, apache nifi minifi c\+\+ +1 moreApache NiFi MiNiFi C++: Incorrect Certificate Validation in InvokeHTTP for MiNiFi C++CVE-2023-411805.9 Medium
- apache airflow spark providerApache Airflow Spark Provider Deserialization Vulnerability RCECVE-2023-40195Fix available8.8 High
- apache airflow sqoop providerApache Airflow Sqoop Provider: Airflow Sqoop Provider RCE VulnerabilityCVE-2023-27604Fix available8.8 High
- apache tomcat, debian linux +1 moreApache Tomcat: Open redirect with FORM authenticationCVE-2023-41080Public exploitFix available6.1 Medium
- apache airflow, apache software foundation airflow imap provider, airflow smtp provider +2 more +4 moreApache Airflow SMTP Provider, Apache Airflow IMAP Provider, Apache Airflow: SMTP/IMAP client components allowed MITM due to missing Certificate ValidationCVE-2023-39441Fix available5.9 Medium
- apache airflowApache Airflow: Exposure of sensitive connection information, DOS and SSRF on "test connection" featureCVE-2023-37379Fix available8.1 High
- apache airflowSession fixation in Apache Airflow web interfaceCVE-2023-40273Fix available8.0 High
- apache xml graphics batik, debian linux +1 moreApache XML Graphics Batik: Information disclosure vulnerabilityCVE-2022-44729Fix available7.1 High
- apache xml graphics batik, debian linux +1 moreApache XML Graphics Batik: Information disclosure vulnerabilityCVE-2022-44730Fix available4.4 Medium
- apache ivyApache Ivy: XML External Entity vulnerability in Apache IvyCVE-2022-46751Fix available8.2 High
- apache nifiApache NiFi: Incomplete Validation of JDBC and JNDI Connection URLsCVE-2023-40037Public exploitFix available6.5 Medium
- apache software foundation airflow spark provider, apache apache-airflow-providers-apache-drill, apache-airflow-providers-apache-spark +2 moreApache Airflow Spark Provider Arbitrary File Read via JDBCCVE-2023-40272Fix available7.5 High
- apache software foundation airflow drill provider, apache apache-airflow-providers-apache-drill +1 moreApache Airflow Drill Provider Arbitrary File Read VulnerabilityCVE-2023-39553Fix available7.5 High
- Show moreLoading…