Skip to contentApache Software Foundation vulnerabilities
Products
Show 140 moreShow less
Newest
- apache supersetApache Superset: Improper SQL authorisation, parse not checking for specific postgres functionsCVE-2024-53947Fix available2.3 Low
- apache subversion, debian linux +1 moreApache Subversion: mod_dav_svn denial-of-service via control characters in pathsCVE-2024-46901Fix available3.1 Low
- apache hiveApache Hive: Deserialization of untrusted data when fetching partitions from the MetastoreCVE-2022-41137Fix available8.3 High
- apache ozoneApache Ozone: Improper authentication when generating S3 secretsCVE-2024-45106Fix available8.1 High
- apache arrow, apache software foundation arrow r package +1 moreApache Arrow R package: Arbitrary code execution when loading a malicious data fileCVE-2024-52338Fix available9.8 Critical
- apache nimbleApache NimBLE: Lack of input sanitization leading to out-of-bound reads in Number of Completed Packets HCI event handlerCVE-2024-515697.5 High
- apache nimbleApache NimBLE: Lack of input validation in HCI advertising report could lead to potential out-of-bound accessCVE-2024-472505.0 Medium
- apache nimbleApache NimBLE: Lack of input sanitization leading to out-of-bound reads in multiple advertisement handlerCVE-2024-472495.0 Medium
- apache nimbleApache NimBLE: Buffer overflow in NimBLE MESH Bluetooth stackCVE-2024-472486.3 Medium
- apache answerApache Answer: Predictable Authorization Token Using UUIDv1CVE-2024-45719Fix available2.6 Low
- apache nifiApache NiFi: Potential Insertion of Sensitive Parameter Values in Debug LogCVE-2024-52067Fix available6.9 Medium
- apache kafka, apache software foundation kafka clients +1 moreApache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProviderCVE-2024-31141Fix available6.5 Medium
- apache tomcatApache Tomcat: Incorrect JSP tag recycling leads to XSSCVE-2024-52318Public exploitFix available6.1 Medium
- apache tomcatApache Tomcat: Request/response mix-up with HTTP/2CVE-2024-52317Public exploitFix available6.5 Medium
- apache tomcat, debian linux +1 moreApache Tomcat: Authentication bypass when using Jakarta Authentication APICVE-2024-52316Public exploitFix available9.8 Critical
- apache hertzbeatApache HertzBeat: RCE by notice template injection vulnerabilityCVE-2024-411518.8 High
- apache hertzbeatApache HertzBeat: Exposure sensitive token via http GET method with query stringCVE-2024-457917.5 High
- apache hertzbeatApache HertzBeat: Exists Native Deser RCE and file writing vulnerabilitiesCVE-2024-455058.8 High
- apache ofbizApache OFBiz: URLs allowing remote use of Groovy expressions, leading to RCECVE-2024-472089.8 Critical
- apache ofbizApache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE)CVE-2024-489628.9 High
- apache airflowApache Airflow: Sensitive configuration values are not masked in the logs by defaultCVE-2024-45784Fix available7.5 High
- apache traffic serverApache Traffic Server: Server process can fail to drop privilegeCVE-2024-50306Fix available9.1 Critical
- apache traffic serverApache Traffic Server: Valid Host field value can cause crashesCVE-2024-50305Fix available7.5 High
- apache traffic serverApache Traffic Server: Cache key plugin is vulnerable to cache poisoning attackCVE-2024-38479Fix available7.5 High
- apache cloudstackApache CloudStack: Directly downloaded templates can be used to abuse KVM-based infrastructureCVE-2024-503868.5 High
- apache airflowApache Airflow: Secrets not masked in UI when sensitive variables are set via Airflow cliCVE-2024-50378Fix available4.9 Medium
- apache zookeeperApache ZooKeeper: Authentication bypass with IP-based authentication in Admin ServerCVE-2024-51504Fix available9.1 Critical
- apache kylinApache Kylin: Session fixation in web interfaceCVE-2024-23590Fix available9.1 Critical
- apache lucene, lucene.net, apache software foundation lucene.net.replicator +2 moreApache Lucene.Net.Replicator: Remote Code Execution in Lucene.Net.ReplicatorCVE-2024-43383Fix available8.0 High
- apache nifiApache NiFi: Improper Neutralization of Input in Parameter DescriptionCVE-2024-45477Fix available4.6 Medium
- apache syncopeApache Syncope: Stored XSS in Console and EnduserCVE-2024-450316.1 Medium
- apache cloudstackApache CloudStack: Uploaded and registered templates and volumes can be used to abuse KVM-based infrastructureCVE-2024-452198.5 High
- apache cloudstack, apache software foundation cloudstack quota plugin +1 moreApache CloudStack Quota plugin: Access checks not enforced in QuotaCVE-2024-454615.7 Medium
- apache cloudstackApache CloudStack: Incomplete session invalidation on web interface logoutCVE-2024-454626.3 Medium
- apache cloudstackApache CloudStack: Request origin validation bypass makes account takeover possibleCVE-2024-456938.0 High
- apache solrApache Solr: ConfigSets created during a backup restore command are trusted implicitlyCVE-2024-45217Fix available8.1 High
- apache solrApache Solr: Authentication bypass possible using a fake URL Path endingCVE-2024-45216Public exploitFix availableEPSS 92.7%9.8 Critical
- apache artemis, apache software foundation activemq artemis +1 moreApache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeansCVE-2023-50780Public exploitFix availableEPSS 17.3%8.8 High
- apache rollerApache Roller: Weakness in CSRF protection allows privilege escalationCVE-2024-469114.7 Medium
- apache subversionApache Subversion: Command line argument injection on Windows platformsCVE-2024-45720Fix available8.2 High
- apache xml graphics fop, formatting objects processor +1 moreApache XML Graphics FOP: XML External Entity (XXE) ProcessingCVE-2024-28168Fix available7.5 High
- apache commons io, netapp active iq unified manager, bluexp +5 more +7 moreApache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReaderCVE-2024-47554Fix available4.3 Medium
- apache avro, apache software foundation avro java sdk, netapp active iq unified manager +1 more +3 moreApache Avro Java SDK: Arbitrary Code Execution when reading Avro schema (Java SDK)CVE-2024-47561Fix available9.2 Critical
- apache lucene replicatorApache Lucene Replicator: Security Vulnerability in Lucene Replicator - Deserialization IssueCVE-2024-45772Fix available5.1 Medium
- apache maven archetype, apache software foundation maven archetype plugin +1 moreMaven Archetype Plugin: Maven Archetype integration-test may package local settings into the published artifact, possibly containing credentialsCVE-2024-47197Fix available7.5 High
- apache hadoopApache Hadoop: Temporary File Local Information DisclosureCVE-2024-23454Fix available6.2 Medium
- apache answerApache Answer: Avatar URL leaked user email addressesCVE-2024-40761Fix available5.3 Medium
- apache linkis, apache software foundation linkis spark engineconn +1 moreApache Linkis Spark EngineConn: Commons Lang's RandomStringUtils Random string security vulnerabilityCVE-2024-39928Fix available7.5 High
- apache tomcat connectors, debian linux +1 moreApache Tomcat Connectors: mod_jk: local users can view and modify configurationCVE-2024-46544Fix available5.9 Medium
- apache hertzbeatApache HertzBeat: RCE by snakeYaml deser load malicious xmlCVE-2024-42323Public exploit8.8 High
- Show moreLoading…