Skip to contentApache vulnerabilities
Products
Show 140 moreShow less
Newest
- x-stream xstream, apache activemq, jmeter +13 more +15 moreXStream is vulnerable to a Remote Command Execution attackCVE-2021-21345Public exploitFix availableEPSS 72.3%5.8 Medium
- x-stream xstream, apache activemq, jmeter +13 more +15 moreXStream is vulnerable to an Arbitrary Code Execution attackCVE-2021-21344Fix availableEPSS 76.0%5.3 Medium
- x-stream xstream, apache activemq, jmeter +12 more +14 moreXStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rightsCVE-2021-21343Fix availableEPSS 46.7%5.3 Medium
- x-stream xstream, apache activemq, jmeter +12 more +14 moreA Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local hostCVE-2021-21342Fix availableEPSS 50.0%5.3 Medium
- x-stream xstream, apache activemq, jmeter +10 more +12 moreXStream can cause a Denial of ServiceCVE-2021-21341Public exploitFix availableEPSS 77.8%7.5 High
- apache ofbizRCE vulnerability in latest Apache OFBiz due to Java serialisation using RMICVE-2021-26295Public exploitEPSS 97.8%9.8 Critical
- apache pdfbox, fedoraproject fedora, oracle banking corporate lending process management +16 more +18 moreA carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the fileCVE-2021-27906Fix available5.5 Medium
- apache pdfbox, fedoraproject fedora, oracle banking trade finance process management +12 more +14 moreA carefully crafted PDF file can trigger an infinite loop while loading the fileCVE-2021-27807Fix available5.5 Medium
- apache ambariIn Apache Ambari versions 2.6.2.2 and earlier, malicious users can construct file names for...CVE-2020-139247.5 High
- apache hiveTiming attack in Cookie signature verificationCVE-2020-1926Fix available5.9 Medium
- apache openmeetingsApache OpenMeetings: bandwidth can be overloaded with public web serviceCVE-2021-27576Fix available7.5 High
- apache velocity tools, debian linux +1 moreVelocity Tools XSS VulnerabilityCVE-2020-13959Fix available6.1 Medium
- apache velocity engine, wss4j, debian linux +13 more +15 moreVelocity Sandbox BypassCVE-2020-13936Fix availableEPSS 22.7%8.8 High
- netty io.netty:netty-codec-http2, netty, apache kudu +6 more +8 morePossible request smuggling in HTTP/2 due missing validationCVE-2021-21295Fix availableEPSS 18.9%5.9 Medium
- apache oozieOozie local privilege escalationCVE-2020-354514.7 Medium
- apache supersetApache Superset stored XSS on Dashboard markdownCVE-2021-27907Fix availableEPSS 86.4%5.4 Medium
- apache ambariStored XSS in Apache AmbariCVE-2020-1936Fix available6.1 Medium
- apache asterixdbunzip directory traversalCVE-2020-94795.5 Medium
- apache tomcat, debian linux, oracle agile product lifecycle management +9 more +11 moreIncomplete fix for CVE-2020-9484CVE-2021-25329Fix available7.0 High
- apache tomcat, debian linux, oracle agile product lifecycle management +9 more +11 moreApache Tomcat h2c request mix-upCVE-2021-25122Fix availableEPSS 18.1%7.5 High
- eclipse jetty, the eclipse foundation eclipse jetty, apache nifi +14 more +16 moreDOS vulnerability for Quoted Quality CSV headersCVE-2020-27223Public exploitFix availableEPSS 78.0%5.2 Medium
- apache xmlgraphics commons, fedoraproject fedora +1 moreServer-side request forgery (SSRF) in Apache XmlGraphics CommonsCVE-2020-11988Fix available8.2 High
- apache batik, debian linux, fedoraproject fedora +19 more +21 moreServer-side request forgery (SSRF) in Apache BatikCVE-2020-11987Fix availableEPSS 13.6%8.2 High
- apache livy, apache software foundation livy (incubating) +1 moreApache Livy (Incubating) is vulnerable to cross site scriptingCVE-2021-26544Fix available5.4 Medium
- apache myfaces, apache software foundation myfaces core, netapp oncommand insight +2 moreCross-Site Request Forgery (CSRF) vulnerability in Apache MyFacesCVE-2021-26296Fix available7.5 High
- apache airflowApache Airflow: Lineage API endpoint for Experimental API missed authentication checkCVE-2021-26697Fix available5.3 Medium
- apache airflowCWE-284 Improper Access Control on Configurations Endpoint for the Stable APICVE-2021-26559Fix available6.5 Medium
- npm package system information library for node.js, sebhildebrandt systeminformation, apache cordova +2 moreCommand Injection VulnerabilityCVE-2021-21315In KEVPublic exploitFix availableEPSS 90.7%7.1 High
- apache thrift, hive, oracle communications cloud native core network slice selection function +1 more +3 moreUncontrolled Resource Consumption in Apache ThriftCVE-2020-13949Fix available7.5 High
- apache subversion, debian linux +1 moreRemote unauthenticated denial-of-service in Subversion mod_authz_svnCVE-2020-17525Fix availableEPSS 40.1%7.5 High
- apache activemq, oracle communications session report manager, communications session route manager +2 moreCross-site scripting (XSS) in Apache ActiveMQCVE-2020-13947Fix availableEPSS 79.2%6.1 Medium
- apache shiroAuthentication bypass in Apache ShiroCVE-2020-17523Public exploitFix availableEPSS 85.9%9.8 Critical
- apache cassandraAuthentication Bypass in Apache CassandraCVE-2020-17516Fix available7.5 High
- apache druidAuthenticated users can override system configurations in their requests which allows them to execute arbitrary code.CVE-2021-25646Public exploitFix availableEPSS 99.1%8.8 High
- apache artemis, apache software foundation activemq artemis, netapp oncommand workflow automation +2 moreFlaw in ActiveMQ Artemis OpenWire supportCVE-2021-26118Fix available7.5 High
- apache activemq, artemis, debian linux +5 more +7 moreActiveMQ: LDAP-Authentication does not verify passwords on servers with anonymous bindCVE-2021-26117Fix availableEPSS 11.5%7.5 High
- apache hadoop, solr, oracle financial services crime and compliance management studio +2 moreImproper Privilege Management in Apache HadoopCVE-2020-9492Fix available8.8 High
- apache traffic controlCache Manipulation Attack in Apache Traffic ControlCVE-2020-17522Fix available5.8 Medium
- openldap, apache bookkeeper, apple mac os x +5 more +7 moreA flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in slapd in the X...CVE-2020-36230Fix availableEPSS 12.1%7.5 High
- apache nutch, netapp snap creator framework +1 moreAn XML external entity (XXE) injection vulnerability exists in the Nutch DmozParserCVE-2021-23901Fix available9.1 Critical
- apache software foundation servicecomb-java-chassis, apache java chassis +1 moreApache ServiceComb Yaml remote deserialization vulnerabilityCVE-2020-17532Fix available8.8 High
- apache guacamoleUpdated guacd packages fix security vulnerabilitiesCVE-2020-11997Fix available4.3 Medium
- fasterxml jackson-databind, apache nifi, debian linux +6 more +8 moreDeserialization of untrusted data in jackson-databindCVE-2021-20190Fix available8.1 High
- apache tomcat, debian linux, oracle agile product lifecycle management +2 moreApache Tomcat information disclosureCVE-2021-24122Fix availableEPSS 22.9%5.9 Medium
- apache xmlbeans, debian linux, netapp oncommand unified manager core package +4 more +6 moreXMLBeans XML Entity ExpansionCVE-2021-23926Fix available9.1 Critical
- apache html\/java apiImproper synchronization in Apache Netbeans HTML/Java APICVE-2020-17534Fix available7.0 High
- apache dolphinschedulerApache DolphinScheduler (incubating) Permission vulnerabilityCVE-2020-13922Fix available6.5 Medium
- apache dubboApache Dubbo default deserialization protocol Hessian2 cause CRECVE-2020-11995Fix available9.8 Critical
- apache flinkApache Flink directory traversal attack: reading remote files through the REST APICVE-2020-17519In KEVPublic exploitFix availableEPSS 98.0%7.5 High
- apache flinkApache Flink directory traversal attack: remote file writing through the REST APICVE-2020-17518Public exploitFix availableEPSS 49.4%7.5 High
- Show moreLoading…