Skip to contentApache vulnerabilities
Products
Show 140 moreShow less
Newest
- apache plc4xApache PLC4X 0.9.0 Buffer overflow in PLC4C via crafted server responseCVE-2021-430838.8 High
- apache log4j, apache software foundation log4j2, debian linux +114 more +116 moreApache Log4j2 does not always protect from infinite recursion in lookup evaluationCVE-2021-45105Public exploitFix availableEPSS 100.0%5.9 Medium
- apache nifiApache NiFi information disclosure by XXECVE-2021-44145Fix available6.5 Medium
- apache log4j, log4j2, cvat computer vision annotation tool +53 more +55 moreApache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attackCVE-2021-45046In KEVPublic exploitFix availableEPSS 100.0%9.0 Critical
- apache sling commons messaging mailSMTPS server hostname not checked when making TLS connection to SMTPS serverCVE-2021-44549Fix available7.4 High
- apache log4j, apache software foundation log4j 1.x, fedoraproject fedora +44 more +46 moreDeserialization of untrusted data in JMSAppender in Apache Log4j 1.2CVE-2021-4104Public exploitFix availableEPSS 80.6%7.5 High
- apache log4j, log4j2, apple xcode +141 more +143 moreApache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpointsCVE-2021-44228In KEVPublic exploitFix availableEPSS 100.0%10.0 Critical
- apache airavata django portalairavata-django-portal allows CRLF log injection because of the lack of escaping in the log statementsCVE-2021-434105.3 Medium
- apache jspwikiArbitrary file deletion on logoutCVE-2021-44140Fix available9.1 Critical
- apache jspwikiXSS vulnerability on Denounce pluginCVE-2021-40369Fix available6.1 Medium
- apache apisixPath traversal in request_uri variableCVE-2021-43557Public exploitFix availableEPSS 13.0%7.5 High
- apache ozoneUnauthenticated access to Ozone Recon HTTP endpointsCVE-2021-41532Fix available5.3 Medium
- apache ozoneOwners of the S3 tokens are not validatedCVE-2021-39236Fix available8.8 High
- apache ozoneAccess mode of block tokens are not enforcedCVE-2021-39235Fix available6.5 Medium
- apache ozoneRaw block data can be read bypassing ACL/authorizationCVE-2021-39234Fix available6.8 Medium
- apache ozoneContainer-related datanode operations can be called without authorizationCVE-2021-39233Fix available9.1 Critical
- apache ozoneMissing admin check for SCM related admin commandsCVE-2021-39232Fix available8.8 High
- apache ozoneMissing authentication/authorization on internal RPC endpointsCVE-2021-39231Fix available9.1 Critical
- apache ozoneOriginal block tokens are persisted and can be retrievedCVE-2021-36372Fix available9.8 Critical
- apache supersetPossible log injectionCVE-2021-42250Fix available6.5 Medium
- apache shenyu, apache software foundation shenyu admin +1 moreApache ShenYu Admin bypass JWT authenticationCVE-2021-37580Public exploitFix availableEPSS 40.8%9.8 Critical
- apache supersetCredentials leakCVE-2021-41972Fix available6.5 Medium
- apache traffic controlLDAP filter injection vulnerability in Traffic OpsCVE-2021-43350Fix available9.8 Critical
- apache shardingsphere-uiDeserialization of Untrusted DataCVE-2021-265587.5 High
- apache traffic serverheap-buffer-overflow with stats-over-http pluginCVE-2021-43082Fix available9.8 Critical
- apache traffic serverATS stops accepting connections on FreeBSDCVE-2021-415857.5 High
- apache traffic server, debian linux +1 moreNot validating origin TLS certificateCVE-2021-38161Fix available8.1 High
- apache traffic server, debian linux +1 moreRequest Smuggling - multiple attacksCVE-2021-37149Fix available7.5 High
- apache traffic server, debian linux +1 moreRequest Smuggling - transfer encoding validationCVE-2021-37148Fix available7.5 High
- apache traffic server, debian linux +1 moreRequest Smuggling - LF line endingCVE-2021-37147Fix available7.5 High
- apache dolphinschedulerDolphinScheduler mysql jdbc connector parameters deserialize remote code executionCVE-2021-27644Fix available8.8 High
- apache mina, oracle banking payments, banking trade finance process management +6 more +8 moreApache MINA HTTP listener DOSCVE-2021-41973Fix available6.5 Medium
- apache stormUnsafe Pre-Authentication Deserialization In WorkersCVE-2021-40865Public exploitFix availableEPSS 64.2%9.8 Critical
- apache stormShell Command Injection Vulnerability in Nimbus Thrift ServerCVE-2021-38294Public exploitFix availableEPSS 83.8%9.8 Critical
- apache supersetPossible SQL Injection when template processing is enabledCVE-2021-41971Fix available8.8 High
- apache supersetXSS vulnerability on Explore pageCVE-2021-32609Fix available5.4 Medium
- apache tomcat, debian linux, netapp hci +15 more +17 moreDoS via memory leak with WebSocket connectionsCVE-2021-42340Fix availableEPSS 11.8%7.5 High
- apache couchdb, apache software foundation ibm cloudant +1 morePrivilege escalation vulnerability when using HTML attachmentsCVE-2021-38295Public exploitFix available7.3 High
- apache traffic controlApache Traffic Control Traffic Ops Email Injection VulnerabilityCVE-2021-42009Fix available4.3 Medium
- apache openofficeContent Manipulation with Certificate Validation AttackCVE-2021-418327.5 High
- apache openofficeTimestamp Manipulation with Signature WrappingCVE-2021-418315.3 Medium
- apache openofficeDouble Certificate AttackCVE-2021-418307.5 High
- apache http server, fedoraproject fedora, netapp cloud backup +3 more +5 morePath Traversal and Remote Code Execution in Apache HTTP Server 2.4.49 and 2.4.50 (incomplete fix of CVE-2021-41773)CVE-2021-42013In KEVPublic exploitFix availableEPSS 100.0%9.8 Critical
- apache openofficeBillion LaughsCVE-2021-404396.5 Medium
- apache openofficeDEB packaging for Apache OpenOffice 4.1.8 installed with a non-root userid and groupidCVE-2021-281297.8 High
- apache http server, fedoraproject fedora, netapp cloud backup +1 more +3 morePath traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49CVE-2021-41773In KEVPublic exploitFix availableEPSS 100.0%9.8 Critical
- apache http server, fedoraproject fedora, netapp cloud backup +1 more +3 morenull pointer dereference in h2 fuzzingCVE-2021-41524Fix availableEPSS 25.8%7.5 High
- apache ddlutils, apache software foundation db ddlutils +1 moreApache ddlutils 1.0 readobject vulnerabilityCVE-2021-416169.8 Critical
- apache druidApache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended (incomplete fix of CVE-2021-26920)CVE-2021-36749Public exploitFix availableEPSS 80.9%6.5 Medium
- apache openofficeBuffer overflow from a crafted DBF fileCVE-2021-33035Fix availableEPSS 50.6%7.8 High
- Show moreLoading…