Skip to contentApache Software Foundation vulnerabilities
Products
Show 140 moreShow less
Newest
- apache zeppelinApache Zeppelin: XSS vulnerability in the helium moduleCVE-2024-31868Fix available6.1 Medium
- apache zeppelinApache Zeppelin: Interpreter download command does not escape malicious code injectionCVE-2024-31866Fix available9.8 Critical
- apache zeppelinApache Zeppelin: Cron arbitrary user impersonation with improper privilegesCVE-2024-31865Fix available6.5 Medium
- apache zeppelinApache Zeppelin: Remote code execution by adding malicious JDBC connection stringCVE-2024-31864Fix available9.8 Critical
- apache zeppelinApache Zeppelin: Replacing other users notebook, bypassing any permissionsCVE-2024-31863Fix available5.3 Medium
- apache zeppelinApache Zeppelin: Denial of service with invalid notebook nameCVE-2024-31862Fix available5.3 Medium
- apache zeppelin, apache software foundation zeppelin sap +1 moreApache Zeppelin SAP: connecting to a malicious SAP server allowed it to perform XXECVE-2022-47894Fix available5.3 Medium
- apache zeppelinApache Zeppelin: CSRF vulnerability in the Credentials pageCVE-2021-286565.4 Medium
- apache zeppelinApache Zeppelin: Path traversal vulnerabilityCVE-2024-31860Fix available6.5 Medium
- apache nimbleApache NimBLE: Denial of service in NimBLE Bluetooth stackCVE-2024-247467.5 High
- apache http server, apple macos, broadcom fabric operating system +4 more +6 moreApache HTTP Server: HTTP Response Splitting in multiple modulesCVE-2024-24795Fix available6.3 Medium
- apache http server, apple macos, broadcom fabric operating system +4 more +6 moreApache HTTP Server: HTTP response splittingCVE-2023-38709Public exploitFix available7.3 High
- apache cloudstackApache CloudStack: The extraconfig feature can be abused to load hypervisor resources on a VM instanceCVE-2024-290086.4 Medium
- apache cloudstackApache CloudStack: When downloading templates or ISOs, the management server and SSVM follow HTTP redirects with potentially dangerous consequencesCVE-2024-290077.3 High
- apache cloudstackApache CloudStack: x-forwarded-for HTTP header parsed by defaultCVE-2024-290069.8 Critical
- apache pulsarApache Pulsar: Improper Authorization For Namespace and Topic Management EndpointsCVE-2024-29834Fix available6.4 Medium
- apache fineractApache Fineract: Under certain circumstances, this vulnerability allowed users, without specific permissions, to escalate their privileges to any role.CVE-2024-235378.4 High
- apache fineractApache Fineract: Under certain system configurations, the sqlSearch parameter was vulnerable to SQL injection attacks, potentially allowing attackers to manipulate database queries.CVE-2024-235389.9 Critical
- apache fineractApache Fineract: Under certain system configurations, the sqlSearch parameter for specific endpoints was vulnerable to SQL injection attacks, potentially allowing attackers to manipulate database quer…CVE-2024-235398.3 High
- apache http server, fedoraproject fedora, netapp ontap +2 moreApache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation framesCVE-2024-27316Public exploitFix availableEPSS 88.8%7.5 High
- apache airflowApache Airflow: Potentially harmful permission changing by log task handlerCVE-2024-29735Fix available5.3 Medium
- apache dorisApache Doris: Downloading arbitrary remote jar files resulting in remote command executionCVE-2024-274389.8 Critical
- apache dorisApache Doris: Possible race conditionCVE-2024-263075.3 Medium
- apache commons configuration, fedoraproject fedora, netapp ontap tools +1 more +3 moreApache Commons Configuration: StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator()CVE-2024-29131Fix available7.3 High
- apache commons configuration, fedoraproject fedora +1 moreApache Commons Configuration: StackOverflowError calling ListDelimiterHandler.flatten(Object, int) with a cyclical object treeCVE-2024-29133Fix available5.4 Medium
- apache wicketApache Wicket: Possible bypass of CSRF protectionCVE-2024-27439Fix available6.5 Medium
- apache hop engineApache Hop Engine: ID isn't escaped when generating HTMLCVE-2024-24683Fix available6.5 Medium
- apache cxf, netapp oncommand workflow automation, ontap tools +2 moreApache CXF SSRF Vulnerability using the Aegis databindingCVE-2024-28752Public exploitFix available9.3 Critical
- apache zookeeperApache ZooKeeper: Information disclosure in persistent watcher handlingCVE-2024-23944Fix available5.3 Medium
- apache airflowApache Airflow: Ignored Airflow PermissionsCVE-2024-28746Fix available8.1 High
- apache tomcat, debian linux, fedoraproject fedora +2 moreApache Tomcat: WebSocket DoS with incomplete closing handshakeCVE-2024-23672Fix available6.3 Medium
- apache tomcat, debian linux, fedoraproject fedora +2 moreApache Tomcat: HTTP/2 header handling DoSCVE-2024-24549Public exploitFix availableEPSS 23.1%7.5 High
- apache pulsarApache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS ProxyingCVE-2024-27894Fix available8.5 High
- apache pulsarApache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File ModificationCVE-2024-27317Fix availableEPSS 56.9%8.4 High
- apache pulsarApache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code ExecutionCVE-2024-27135Fix available8.5 High
- apache pulsarApache Pulsar: Improper Authentication for Pulsar Proxy Statistics EndpointCVE-2022-34321Fix available8.2 High
- apache pulsarApache Pulsar: Improper Authorization For Topic-Level Policy ManagementCVE-2024-28098Fix available6.4 Medium
- apache dorisApache Doris: Timing Attack weaknessCVE-2023-413139.8 Critical
- apache linkis, apache software foundation linkis datasource +1 moreApache Linkis DataSource: DataSource module Oracle SQL Database Password LoggedCVE-2023-50740Fix available5.3 Medium
- apache inlongApache InLong: Logged-in user could exploit an arbitrary file read vulnerabilityCVE-2024-26580Fix available9.1 Critical
- apache archivaApache Archiva: disabling user registration is not effectiveCVE-2024-271387.5 High
- apache archivaApache Archiva: incorrect authentication potentially leading to account takeoverCVE-2024-271397.5 High
- apache archivaApache Archiva: reflected XSSCVE-2024-271405.4 Medium
- apache ambariApache Ambari: Various XSS problemsCVE-2023-50378Fix available6.1 Medium
- apache airflowApache Airflow: Overly broad default permissions for Viewer/Ops (audit logs)CVE-2024-26280Fix available4.7 Medium
- apache airflowApache Airflow: Dag Code and Import Error Permissions IgnoredCVE-2024-27906Fix available5.9 Medium
- apache ofbizApache OFBiz: Path traversal or file inclusionCVE-2024-239465.3 Medium
- apache ofbizApache OFBiz: Path traversal allowing authentication bypass.CVE-2024-25065EPSS 47.7%9.1 Critical
- apache software foundation xerces c++, apache xerces-c, xerces-c\+\+ +2 moreApache Xerces C++: Use-after-free on external DTD scanCVE-2024-23807Fix available9.8 Critical
- apache supersetApache Superset: Improper authorization validation on dashboards and charts importCVE-2024-26016Fix available4.3 Medium
- Show moreLoading…