Skip to contentApache vulnerabilities
Products
Show 140 moreShow less
Newest
- jdom, apache solr, tika +3 more +5 moreXML External Entity (XXE) Injection in JDOMCVE-2021-33813Fix availableEPSS 19.4%7.5 High
- apache chainsaw, log4j, qos reload4j +2 moreJava deserialization in ChainsawCVE-2020-9493Fix available9.8 Critical
- apache http server, debian linux, fedoraproject fedora +3 more +5 moreNULL pointer dereference on specially crafted HTTP/2 requestCVE-2021-31618Fix availableEPSS 52.1%7.5 High
- apache pdfbox, fedoraproject fedora, oracle banking corporate lending process management +4 more +6 moreA carefully crafted PDF file can trigger an infinite loop while loading the fileCVE-2021-31812Fix available5.5 Medium
- apache pdfbox, fedoraproject fedora, oracle banking corporate lending process management +9 more +11 moreA carefully crafted PDF file can trigger an OutOfMemory-Exception while loading a tiny fileCVE-2021-31811Fix available5.5 Medium
- apache http server, debian linux, fedoraproject fedora +3 more +5 moreUnexpected URL matching with 'MergeSlashes OFF'CVE-2021-30641Fix availableEPSS 51.8%5.3 Medium
- apache http server, debian linux, fedoraproject fedora +5 more +7 moreApache HTTP Server mod_session response handling heap overflowCVE-2021-26691Fix availableEPSS 68.1%9.8 Critical
- apache http server, debian linux, fedoraproject fedora +3 more +5 moremod_session NULL pointer dereferenceCVE-2021-26690Public exploitFix availableEPSS 65.1%7.5 High
- apache http server, debian linux, fedoraproject fedora +3 more +5 moremod_auth_digest possible stack overflow by one nul byteCVE-2020-35452Fix availableEPSS 53.2%7.3 High
- apache http server, debian linux, fedoraproject fedora +3 more +5 moremod_proxy_http NULL pointer dereferenceCVE-2020-13950Fix availableEPSS 50.0%7.5 High
- apache http server, mcafee epolicy orchestrator, netapp cloud backup +2 moreImproper Handling of Insufficient PrivilegesCVE-2020-13938Fix availableEPSS 11.8%5.5 Medium
- apache http server, fedoraproject fedora, oracle enterprise manager ops center +2 more +4 moremod_proxy_wstunnel tunneling of non Upgraded connectionsCVE-2019-17567Fix availableEPSS 59.7%5.3 Medium
- apache apisix dashboardBypass network access controlCVE-2021-33190Fix available5.3 Medium
- apache dubboApache Dubbo RCE on customers via Condition route poisoning (Unsafe YAML unmarshaling)CVE-2021-30180Public exploitFix availableEPSS 60.3%9.8 Critical
- apache dubboApache Dubbo Pre-auth RCE via Java deserialization in the Generic filterCVE-2021-30179Fix available9.8 Critical
- apache dubboOpen Redirect or SSRF vulnerability usage of parseURLCVE-2021-25640Fix available6.1 Medium
- apache dubboApache Dubbo RCE on customers via Script route poisoning (Nashorn script injection)CVE-2021-30181Public exploitFix availableEPSS 60.9%9.8 Critical
- apache dubboDubbo Zookeeper does not check serialization idCVE-2021-25641Public exploitFix availableEPSS 21.2%9.8 Critical
- dpgaspar flask-appbuilder, apache airflow +1 moreObservable Response Discrepancy in Flask-AppBuilderCVE-2021-29621Fix available5.3 Medium
- apache fineractdisabled hostname verificiationCVE-2020-175147.4 High
- apache pulsarAuthentication with JWT allows use of “none”-algorithmCVE-2021-22160Fix availableEPSS 52.9%9.8 Critical
- apache wicketDNS proxy and possible amplification attackCVE-2021-23937Fix available7.5 High
- apache traffic serverApache Traffic Server 9.0.0 is vulnerable to a remote DOS attack on the experimental Slicer plugin.CVE-2021-277377.5 High
- apache unomiApache Unomi log injectionCVE-2021-31164Fix available7.5 High
- apache airflowApache Airflow Reflected XSS via Origin Query Argument in URLCVE-2021-28359Fix availableEPSS 14.4%6.1 Medium
- apache ofbizUnsafe deserialization in Apache OFBizCVE-2021-30128Public exploitEPSS 81.2%9.8 Critical
- apache ofbizRCE vulnerability in latest Apache OFBiz due to Java serialisation using RMICVE-2021-29200Public exploitEPSS 55.4%9.8 Critical
- apache tapestryAn Information Disclosure due to insufficient input validation exists in Apache Tapestry 5.4.0 and laterCVE-2021-30638Fix available7.5 High
- apache supersetApache Superset Open RedirectCVE-2021-28125Fix availableEPSS 64.0%6.1 Medium
- apache ozoneOzone S3 Gateway allows bucket and key access to non authenticated usersCVE-2020-175177.5 High
- apache maven, oracle financial services analytical applications infrastructure, goldengate big data and application adapters +1 more +3 moreblock repositories using http by defaultCVE-2021-26291Public exploitFix available9.1 Critical
- giflib project giflib, apache bookkeeper +1 moreAn issue was discovered in giflib through 5.1.4. DumpScreen2RGB in gif2rgb.c has a heap-based...CVE-2020-23922Fix available7.1 High
- apache openofficeCode execution in Apache OpenOffice via non-http(s) schemes in HyperlinksCVE-2021-302458.8 High
- apache tapestryBypass of the fix for CVE-2019-0195CVE-2021-27850Public exploitFix availableEPSS 93.6%9.8 Critical
- apache commons io, debian linux, netapp active iq unified manager +57 more +59 morePossible limited path traversal vulnerabily in Apache Commons IOCVE-2021-29425Public exploitFix availableEPSS 10.5%4.8 Medium
- apache solrApache Solr Unprivileged users may be able to perform unauthorized read/write to collectionsCVE-2021-29943Fix available9.1 Critical
- apache solrMisapplied Zookeeper ACLs can result in leakage of configured authentication and authorization settingsCVE-2021-29262Fix available7.5 High
- apache solrSSRF vulnerability with the Replication handlerCVE-2021-27905Public exploitFix availableEPSS 93.1%9.8 Critical
- apache subversion, apple macos, debian linux +1 more +3 moreApache Subversion mod_dav_svn is vulnerable to memory corruptionCVE-2022-24070Fix available7.5 High
- apache subversion, apple macos, debian linux +1 more +3 moreApache Subversion SVN authz protected copyfrom paths regressionCVE-2021-28544Fix available4.3 Medium
- apache cxf, oracle business intelligence, communications diameter intelligence hub +3 more +5 moreOAuth 2 authorization service vulnerable to DDos attacksCVE-2021-22696Fix available7.5 High
- eclipse jetty, the eclipse foundation eclipse jetty, apache ignite +21 more +23 moreDirectory exposure in jettyCVE-2021-28163Fix available2.7 Low
- apache tika, oracle communications messaging server, healthcare foundation +2 more +4 moreInfinite loop in Apache Tika's MP3 parserCVE-2021-28657Fix available5.5 Medium
- apache druidApache Druid Authenticated users can execute arbitrary code from malicious MySQL database systems.CVE-2021-26919Fix availableEPSS 35.2%8.8 High
- x-stream xstream, apache activemq, jmeter +13 more +15 moreXStream is vulnerable to an Arbitrary Code Execution attackCVE-2021-21351Fix availableEPSS 82.1%5.4 Medium
- x-stream xstream, apache activemq, jmeter +13 more +15 moreXStream is vulnerable to an Arbitrary Code Execution attackCVE-2021-21350Fix availableEPSS 15.2%5.3 Medium
- x-stream xstream, apache activemq, jmeter +14 more +16 moreA Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local hostCVE-2021-21349Public exploitFix availableEPSS 46.8%6.1 Medium
- x-stream xstream, apache activemq, jmeter +13 more +15 moreXStream is vulnerable to an attack using Regular Expression for a Denial of Service (ReDos)CVE-2021-21348Fix availableEPSS 13.8%5.3 Medium
- x-stream xstream, apache activemq, jmeter +13 more +15 moreXStream is vulnerable to an Arbitrary Code Execution attackCVE-2021-21347Fix availableEPSS 14.3%6.1 Medium
- x-stream xstream, apache activemq, jmeter +13 more +15 moreXStream is vulnerable to an Arbitrary Code Execution attackCVE-2021-21346Fix availableEPSS 76.4%6.1 Medium
- Show moreLoading…