Skip to contentApache Software Foundation vulnerabilities
Products
Show 140 moreShow less
Newest
- apache supersetApache Superset: Improper data authorization when creating a new datasetCVE-2024-24779Fix available5.0 Medium
- apache supersetApache Superset: Improper Neutralisation of custom SQL on embedded contextCVE-2024-24772Fix available4.3 Medium
- apache supersetApache Superset: Improper validation of SQL statements allows for unauthorized access to dataCVE-2024-24773Fix available4.9 Medium
- apache supersetApache Superset: Improper error handling on alertsCVE-2024-27315Fix available4.3 Medium
- apache ambariApache Ambari: authenticated users could perform XXE to read arbitrary files on the serverCVE-2023-50380Fix available6.5 Medium
- apache james mime4jApache James Mime4J: Mime4J DOM header injectionCVE-2024-21742Fix available5.3 Medium
- apache auroraApache Aurora: padding oracle can allow construction an authentication cookieCVE-2024-279059.1 Critical
- apache james, apache software foundation james server +1 moreSMTP smuggling in Apache JamesCVE-2023-51747Fix available7.1 High
- apache james, james server +1 moreApache James server: Privilege escalation via JMX pre-authentication deserialisationCVE-2023-51518Public exploitFix available9.8 Critical
- apache ambariApache Ambari: authenticated users could perform command injection to perform RCECVE-2023-50379Fix available8.8 High
- apache camelApache Camel issue on ExchangeCreatedEventCVE-2024-22371Public exploitFix available2.9 Low
- apache dolphinschedulerApache DolphinScheduler: Arbitrary js execution as root for authenticated usersCVE-2024-23320Fix available8.8 High
- apache answerApache Answer: Pixel Flood Attack by uploading the large pixel fileCVE-2024-22393Public exploitFix available9.1 Critical
- apache answerApache Answer: XSS vulnerability when submitting summaryCVE-2024-23349Fix available5.4 Medium
- apache answerApache Answer: Repeated submission at registration created duplicate users with the same nameCVE-2024-26578Fix available5.9 Medium
- apache airflow mongo provider, apache-airflow-providers-mongo +1 moreApache Airflow Mongo Provider: Certificate validation isn't respected even if SSL is enabled for apache-airflow-providers-mongoCVE-2024-25141Fix available9.1 Critical
- apache camelApache Camel: Camel-CassandraQL: Unsafe Deserialization from CassandraAggregationRepositoryCVE-2024-23114Fix available9.8 Critical
- apache camelApache Camel: Camel-SQL: Unsafe Deserialization from JDBCAggregationRepositoryCVE-2024-22369Public exploitFix available7.8 High
- apache dolphinschedulerApache DolphinScheduler: Arbitrary File Read VulnerabilityCVE-2023-51770Public exploitFix available7.5 High
- apache dolphinschedulerApache DolphinScheduler: Session do not expire after password changeCVE-2023-50270Fix available6.5 Medium
- apache dolphinschedulerApache DolphinScheduler: Insecure TLS TrustManager used in HttpUtilCVE-2023-49250Fix available7.3 High
- apache dolphinschedulerRemote Code Execution in Apache DolphinschedulerCVE-2023-49109Public exploitFix available9.8 Critical
- apache commons compressApache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP fileCVE-2024-25710Fix available8.1 High
- apache commons compressApache Commons Compress: OutOfMemoryError unpacking broken Pack200 fileCVE-2024-26308Public exploitFix available5.5 Medium
- apache supersetApache Superset: Allows for uncontrolled resource consumption via a ZIP bomb (version range fix for CVE-2023-46104)CVE-2024-23952Fix available6.5 Medium
- apache solrApache Solr: System Property redaction logic inconsistency can lead to leaked passwordsCVE-2023-50291Fix available7.5 High
- apache solrApache Solr: Solr Schema Designer blindly "trusts" all configsets, possibly leading to RCE by unauthenticated usersCVE-2023-50292Fix available7.5 High
- apache solrApache Solr: Solr can expose ZooKeeper credentials via Streaming ExpressionsCVE-2023-50298Fix available7.5 High
- apache solrApache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSetsCVE-2023-50386Public exploitFix availableEPSS 83.7%8.8 High
- apache brpcApache bRPC: HTTP request smuggling vulnerabilityCVE-2024-234527.5 High
- apache ozoneApache Ozone: Missing mutual TLS authentication in one of the service internal Ozone Storage Container Manager endpointsCVE-2023-39196Fix available5.3 Medium
- apache pulsarApache Pulsar: Timing attack in SASL token signature verificationCVE-2023-51437Fix available7.4 High
- apache sling servlets resolverApache Sling Servlets Resolver: Malicious code execution via path traversalCVE-2024-23673Public exploitFix available8.5 High
- apache servicecomb, apache software foundation servicecomb service-center +1 moreApache ServiceComb Service-Center: attacker can perform SSRF through the frontend APICVE-2023-44313Fix available7.6 High
- apache servicecomb, apache software foundation servicecomb service-center +1 moreApache ServiceComb Service-Center: attacker can query all environment variables of the service-center serverCVE-2023-44312Fix available5.8 Medium
- apache kylinApache Kylin: Insufficiently protected credentials in config fileCVE-2023-29055Fix available7.5 High
- apache airflowApache Airflow: Bypass permission verification to read code of other dagsCVE-2023-50944Fix available6.5 Medium
- apache airflowApache Airflow: Potential pickle deserialization vulnerability in XComsCVE-2023-50943Fix available7.5 High
- apache airflow, apache software foundation airflow cncf kubernetes provider, apache apache-airflow-providers-cncf-kubernetes +2 moreApache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer serviceCVE-2023-51702Fix available6.5 Medium
- apache supersetApache Superset: Stored XSS in Dashboard Title and Chart TitleCVE-2023-49657Fix available9.6 Critical
- apache tomcatApache Tomcat: Leaking of unrelated request bodies in default error pageCVE-2024-21733Public exploitFix availableEPSS 14.3%5.3 Medium
- apache iotdbApache IoTDB: Remote Code Execution (RCE) risk via the UDFCVE-2023-46226Fix available9.8 Critical
- apache shiroApache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewritingCVE-2023-46749Fix available6.5 Medium
- apache solrApache Solr: Host environment variables are published via the Metrics APICVE-2023-50290Public exploitFix availableEPSS 68.4%6.5 Medium
- apache answerApache Answer: Repeated submissions using scripts resulted in an abnormal number of collections for questions.CVE-2023-49619Fix available3.1 Low
- apache axisApache Axis 1.x (EOL) may allow SSRF when untrusted input is passed to the service admin HTTP APICVE-2023-51441Fix available7.2 High
- apache inlongApache InLong: Remote Code Execution vulnerability in Apache InLong ManagerCVE-2023-51784Fix available9.8 Critical
- apache inlongApache InLong: Arbitrary File Read Vulnerability in Apache InLong ManagerCVE-2023-51785Fix available7.5 High
- apache dolphinschedulerApache DolphinScheduler: Arbitrary js execute as root for authenticated usersCVE-2023-49299Fix available8.8 High
- apache openofficeApache OpenOffice: Macro URL arbitrary script executionCVE-2023-478048.8 High
- Show moreLoading…