Skip to contentApache Software Foundation vulnerabilities
Products
Show 140 moreShow less
Newest
- apache ofbizApache OFBiz: Pre-authentication Remote Code Execution (RCE) vulnerabilityCVE-2023-51467Public exploitEPSS 96.0%9.8 Critical
- apache ofbizApache OFBiz: Arbitrary file properties reading and SSRF attackCVE-2023-50968EPSS 63.4%7.5 High
- apache iotdbApache IoTDB: Unsafe deserialize map in Sync ToolCVE-2023-51656Fix available9.8 Critical
- apache airflowApache Airflow: Improper access control to DAG resourcesCVE-2023-48291Fix available4.3 Medium
- apache airflowApache Airflow: Improper access control vulnerability on the "varimport" endpointCVE-2023-50783Fix available6.5 Medium
- apache airflowApache Airflow: DAG Params alllow to embed unchecked JavascriptCVE-2023-47265Fix available5.4 Medium
- apache airflowApache Airflow: Missing CSRF protection on DAG/triggerCVE-2023-49920Fix available6.5 Medium
- apache pulsar, apache software foundation pulsar websocket proxy +1 moreApache Pulsar WebSocket Proxy: Improper Authentication for WebSocket Proxy Endpoint Allows DoSCVE-2023-37544Fix available7.5 High
- apache guacamoleApache Guacamole: Integer overflow in handling of VNC image buffersCVE-2023-43826Fix available7.5 High
- apache supersetApache Superset: Privilege Escalation VulnerabilityCVE-2023-49734Fix available7.7 High
- apache supersetApache Superset: SQL Injection on where_in JINJA macroCVE-2023-49736Fix available6.5 Medium
- apache supersetApache Superset: Allows for uncontrolled resource consumption via a ZIP bombCVE-2023-46104Fix available6.5 Medium
- apache dorisApache Doris: Missing API authentication allowed DoSCVE-2023-413148.2 High
- apache streampark, apache software foundation streampark (incubating) +1 moreApache StreamPark (incubating): Authenticated system users could trigger SQL injection vulnerabilityCVE-2023-30867Fix available4.9 Medium
- apache streampark, apache software foundation streampark (incubating) +1 moreApache StreamPark (incubating): Authenticated system users could trigger remote command executionCVE-2023-49898Fix available7.2 High
- apache dubboApache Dubbo: Bypass deny serialize list check in Apache DubboCVE-2023-46279Fix available9.8 Critical
- apache dubboBypass serialize checks in Apache DubboCVE-2023-29234Fix available9.8 Critical
- apache shiroApache Shiro: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Shiro.CVE-2023-46750Fix available6.1 Medium
- apache couchdb, apache software foundation ibm cloudant +1 moreApache CouchDB, IBM Cloudant: Privilege Escalation Using _design DocumentsCVE-2023-45725Fix available5.7 Medium
- apache strutsApache Struts: File upload component had a directory traversal vulnerabilityCVE-2023-50164Public exploitFix availableEPSS 80.8%9.8 Critical
- apache strutsApache Struts: excessive disk usageCVE-2023-41835Fix available7.5 High
- apache ofbizPre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still presentCVE-2023-49070Public exploitEPSS 95.4%9.8 Critical
- apache tilesApache Tiles: Unvalidated input may lead to path traversal and XXECVE-2023-497357.5 High
- apache cocoonApache Cocoon's StreamGenerator is vulnerable to XXE injectionCVE-2023-49733Fix available9.8 Critical
- apache dolphinschedulerApache DolphinScheduler: Authenticated users could delete UDFs in resource center they were not authorized forCVE-2023-49620Fix available6.5 Medium
- apache cocoonApache Cocoon: SQL injection in DatabaseCookieAuthenticatorActionCVE-2022-45135Fix available9.8 Critical
- apache supersetApache Superset: Lack of rate limiting allows for possible denial of serviceCVE-2023-42504Fix available5.8 Medium
- apache supersetApache Superset: Sensitive information disclosure on db connection detailsCVE-2023-42505Fix available4.3 Medium
- apache supersetApache Superset: Open Redirect VulnerabilityCVE-2023-42502Fix available4.8 Medium
- apache tomcatApache Tomcat: HTTP request smuggling via malformed trailer headersCVE-2023-46589Fix available7.5 High
- apache activemqApache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCECVE-2022-41678Public exploitFix availableEPSS 85.7%8.8 High
- apache nifiApache NiFi: Improper Neutralization of Input in Advanced User Interface for JoltCVE-2023-49145Fix available7.9 High
- apache supersetApache Superset: Stored XSS on API endpointCVE-2023-43701Fix available4.3 Medium
- apache supersetApache Superset: Unnecessary read permissions within the Gamma roleCVE-2023-42501Fix available4.3 Medium
- apache supersetApache Superset: Privilege escalation with default examples databaseCVE-2023-40610Fix available6.3 Medium
- apache dolphinschedulerApache DolphinScheduler: Information Leakage VulnerabilityCVE-2023-49068Fix available7.5 High
- apache dolphinschedulerApache dolphinscheduler sensitive information disclosureCVE-2023-48796Fix available7.5 High
- apache stormApache Storm: Local Information Disclosure Vulnerability in Storm-core on Unix-Like systems due temporary filesCVE-2023-43123Fix available5.5 Medium
- apache submarineApache Submarine: SQL injection from unauthorized loginCVE-2023-37924Fix available9.8 Critical
- apache derbyApache Derby: LDAP injection vulnerability in authenticatorCVE-2022-46337Fix available9.8 Critical
- apache submarineApache Submarine: Fix CVE-2022-1471 SnakeYaml unsafe deserializationCVE-2023-46302Fix available9.8 Critical
- apache hadoopPrivilege escalation in Apache Hadoop Yarn container-executor binary on Linux systemsCVE-2023-26031Fix available7.5 High
- apache airflowApache Airflow: Permission verification bypass allows viewing dagruns of other dagsCVE-2023-42781Fix available6.5 Medium
- apache airflowApache Airflow missing fix for CVE-2023-40611 in 2.7.1 (DAG run broken access)CVE-2023-47037Fix available4.3 Medium
- apache pyarrowPyArrow, PyArrow: Arbitrary code execution when loading a malicious data fileCVE-2023-47248Public exploitFix availableEPSS 13.2%9.8 Critical
- apache software foundation uima java sdk core, uima java sdk cpe, uima java sdk tools +2 more +4 moreApache UIMA Java SDK Core, Apache UIMA Java SDK CPE, Apache UIMA Java SDK Vinci adapter, Apache UIMA Java SDK tools: Potential untrusted code execution when deserializing certain binary CAS formatsCVE-2023-39913Fix available8.8 High
- apache ofbizApache OFBiz: Execution of Solr plugin queries without authenticationCVE-2023-468195.3 Medium
- apache alluraApache Allura: sensitive information exposure via importCVE-2023-468514.9 Medium
- apache airflow, airflow celery provider +1 moreApache Airflow Celery provider, Apache Airflow: Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backendCVE-2023-46215Fix available7.5 High
- apache activemq, activemq legacy openwire module, debian linux +3 more +5 moreApache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attackCVE-2023-46604In KEVPublic exploitFix availableEPSS 100.0%10.0 Critical
- Show moreLoading…