Skip to contentApache vulnerabilities
Products
Show 140 moreShow less
Newest
- apache traffic serverThe HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.1 allows remote...CVE-2015-3249Fix available9.8 Critical
- apache wss4jUse of a Broken or Risky Cryptographic Algorithm in Apache WSS4JCVE-2015-0226Fix available7.5 High
- apache qpidqpidd in Apache Qpid 0.30 and earlier allows remote attackers to cause a denial of service ...CVE-2015-0224EPSS 15.1%7.5 High
- apache traffic serverApache Traffic Server 5.1.x before 5.1.1 allows remote attackers to bypass access restrictions by...CVE-2014-3624Fix available9.8 Critical
- apache wicketApache Wicket Sensitive Data ExposureCVE-2014-3526Fix available7.5 High
- apache subversionlibsvn_fs_fs/fs_fs.c in Apache Subversion 1.8.x before 1.8.2 might allow remote authenticated...CVE-2013-42468.8 High
- apache cordovaApache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set...CVE-2015-18355.3 Medium
- apache activemqImproper Restriction of XML External Entity Reference in Apache ActiveMQCVE-2014-3600Fix available9.8 Critical
- apache activemq apolloApache ActiveMQ Apollo XXE VulnerabilityCVE-2014-3579Fix available9.8 Critical
- apache ws-xmlrpcApache XML-RPC vulnerable to Deserialization of Untrusted DataCVE-2016-5003Fix availableEPSS 14.9%9.8 Critical
- apache xml-rpcApache XML-RPC XXE VulnerabilityCVE-2016-50027.8 High
- apache ofbizApache OFBiz 10.04.x before 10.04.02 allows remote attackers to execute arbitrary code via...CVE-2012-16229.8 Critical
- apache portable runtime utility, apache software foundation portable runtime +1 moreApache Portable Runtime Utility (APR-util) 1.6.0 and prior fail to validate the integrity of SDBM...CVE-2017-12618Fix available4.7 Medium
- apache portable runtime, debian linux, redhat enterprise linux desktop +8 more +10 moreWhen apr_time_exp*() or apr_os_exp_time*() functions are invoked with an invalid month field...CVE-2017-12613Fix available7.1 High
- apache derbyImproper Access Control in Apache DerbyCVE-2010-2232Fix available7.5 High
- apache software foundation james, apache james server +1 moreApache James Privilege EscalationCVE-2017-12628Fix available7.8 High
- apache nifiInjection in Apache NiFiCVE-2017-5636Fix available9.8 Critical
- apache nifiImproper Authentication In Apache NiFiCVE-2017-5635Fix available7.5 High
- apache nifiCross-site Scripting in Apache NiFiCVE-2016-8748Fix available5.4 Medium
- apache struts, netapp oncommand balance +1 moreApache Struts forced double OGNL evaluationCVE-2016-4461Fix available8.8 High
- apache solr, canonical ubuntu linux, debian linux +1 more +3 moreRemote code execution occurs in Apache SolrCVE-2017-12629Public exploitFix availableEPSS 92.5%9.8 Critical
- apache rangerModerate severity vulnerability that affects org.apache.ranger:rangerCVE-2016-6815Fix available6.5 Medium
- apache openmeetingsApache OpenMeetings RCECVE-2016-8736Fix available9.8 Critical
- apache nifiXML External Entity Reference in Apache NiFiCVE-2017-12623Fix available6.5 Medium
- apache rollerThe XML-RPC protocol support in Apache Roller before 5.0.3 allows attackers to conduct XML...CVE-2014-0030Public exploitEPSS 16.9%9.8 Critical
- apache impalaIn Apache Impala (incubating) before 2.10.0, a malicious user with "ALTER" permissions on an...CVE-2017-97926.5 Medium
- apache tomcat, canonical ubuntu linux, debian linux +55 more +57 moreUnrestricted Upload of File with Dangerous Type Apache TomcatCVE-2017-12617In KEVPublic exploitFix availableEPSS 100.0%8.1 High
- apache opennlpImproper Restriction of XML External Entity Reference in Apache OpenNLPCVE-2017-12620Fix available9.8 Critical
- apache geodeApache Geode vulnerable to Exposure of Sensitive InformationCVE-2017-9797Fix available6.5 Medium
- apache wicketApache Wicket vulnerable to CSRF attacksCVE-2016-6806Fix available8.8 High
- apache wicketApache Wicket allows attackers to check for third-party librariesCVE-2014-0043Public exploitFix available5.3 Medium
- apache geodeApache Geode gfsh query vulnerabilityCVE-2017-9794Fix available4.3 Medium
- apache tikaApache Tika does not properly initialize the XML parser or choose handlersCVE-2016-4434Fix available7.8 High
- apache mesosUse after free in Apache MesosCVE-2017-9790Fix available7.5 High
- apache mesosDenial of service in Apache MesosCVE-2017-7687Fix available7.5 High
- apache commons jellyImproper Restriction of XML External Entity Reference in JellyCVE-2017-12621Fix available9.8 Critical
- apache strutsCross-site Scripting in Apache StrutsCVE-2015-5169Fix available6.1 Medium
- apache strutsApache Struts allows entering a custom URL in a form field if built-in URLValidator is usedCVE-2017-9804Fix available7.5 High
- apache strutsThe REST Plugin in Apache Struts is using an outdated XStream libraryCVE-2017-9793Fix available7.5 High
- apache strutsApache Struts 2.0.1 uses an unintentional expression in a Freemarker tag instead of string literalCVE-2017-12611Public exploitFix availableEPSS 87.1%9.8 Critical
- apache strutsApache Struts vulnerable to possible DoS attack when using URLValidatorCVE-2016-8738Fix available5.9 Medium
- apache strutsPath Traversal in Apache StrutsCVE-2016-6795Fix available9.8 Critical
- apache tomcat, netapp 7-mode transition tool, oncommand balance +19 more +21 moreWhen running Apache Tomcat on Windows with HTTP PUTs enabled it was possible to upload a JSP file to the serverCVE-2017-12615In KEVPublic exploitFix availableEPSS 99.7%8.1 High
- apache tomcatExposure of Sensitive Information to an Unauthorized Actor in Apache TomcatCVE-2017-12616Fix availableEPSS 70.1%7.5 High
- apache solrApache Solr Kerberos delegation token functionality flawsCVE-2017-9803Fix available7.5 High
- apache http server, debian linux +1 moreApache httpd allows remote attackers to read secret data from process memory if the Limit...CVE-2017-9798Public exploitFix availableEPSS 94.7%7.5 High
- apache wicketApache Wicket insecure defaultsCVE-2014-7808Fix available7.5 High
- apache struts, cisco digital media manager, hosted collaboration solution +4 more +6 moreREST Plugin in Apache Struts uses an XStreamHandler with an instance of XStream for deserialization without any type filteringCVE-2017-9805In KEVPublic exploitFix availableEPSS 99.4%8.1 High
- apache brooklynCross-site Scripting In Apache BrooklynCVE-2017-3165Fix available5.4 Medium
- apache sparkApache Spark Deserialization of Untrusted Data vulnerabilityCVE-2017-12612Fix available7.8 High
- Show moreLoading…