Skip to contentApache vulnerabilities
Products
Show 140 moreShow less
Newest
- apache calciteApache Calcite: potential XEE attacksCVE-2022-39135Fix available9.8 Critical
- apache jamesSTARTTLS command injection in Apache JAMESCVE-2022-28220Fix available7.5 High
- apache iotdbNo authorization of DatabaseConnectController in grafana-connector.CVE-2022-38370Fix available7.5 High
- apache iotdbLogin check vulnerability by session IdCVE-2022-38369Fix available8.8 High
- apache airflowOverly permissive umask for daemonsCVE-2022-38170Fix available4.7 Medium
- apache airflowSession FixationCVE-2022-38054Fix available9.8 Critical
- apache ofbizRegular Expression Denial of Service (ReDoS) vulnerability in Apache OFBizCVE-2022-291587.5 High
- apache ofbizJava Deserialization via RMI Connection from the Solr plugin of Apache OFBizCVE-2022-29063Public exploit9.8 Critical
- apache ofbizServer-Side Template Injection affecting the ecommerce plugin of Apache OFBizCVE-2022-25813Public exploitEPSS 67.3%7.5 High
- apache ofbizUnauth Path Traversal with file corruption affecting the Birt plugin of Apache OFBizCVE-2022-253719.8 Critical
- apache ofbizUnauth Stored XSS vulnerability in the Birt plugin of Apache OFBizCVE-2022-253705.4 Medium
- apache shenyuApache ShenYu Admin Improper Privilege ManagementCVE-2022-37435Fix available8.8 High
- apache geodeApache Geode deserialization of untrusted data flaw when using REST API on Java 8 or Java 11CVE-2022-37023Fix available6.5 Medium
- apache geodeApache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 11CVE-2022-37022Fix available8.8 High
- apache geodeApache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 8.CVE-2022-37021Fix available9.8 Critical
- apache libapreq2, debian linux, fedoraproject fedora +2 morelibapreq2 multipart form parse memory corruptionCVE-2022-22728Fix available7.5 High
- apache hadoopApache Hadoop YARN remote code execution in ZKConfigurationStore of capacity schedulerCVE-2021-25642Public exploitFix available8.8 High
- apache artemis, redhat amq broker +1 moreorg.apache.activemq:artemis-core-client Vulnerable to Out-of-Bounds WriteCVE-2021-4040Fix available5.3 Medium
- apache artemis, apache software foundation activemq artemis, netapp active iq unified manager +1 more +3 moreHTML Injection in ActiveMQ Artemis Web ConsoleCVE-2022-35278Fix available6.1 Medium
- apache flumeImproper Input Validation (JNDI Injection) in JMSMessageConsumerCVE-2022-34916Fix available9.8 Critical
- apache software foundation airflow, apache apache-airflow-providers-docker +1 moreDocker Provider <3.0 RCE vulnerability in example dagCVE-2022-38362Fix available8.8 High
- apache openofficeApache OpenOffice Weak Master KeysCVE-2022-374018.8 High
- apache openofficeApache OpenOffice Static Initialization Vector Allows to Recover Passwords for Web Connections Without Knowing the Master PasswordCVE-2022-374008.8 High
- apache traffic server, debian linux, fedoraproject fedora +2 moreImproper HTTP/2 scheme and method validationCVE-2022-31779Fix available7.5 High
- apache traffic server, debian linux, fedoraproject fedora +2 moreImproper input validation on HTTP/2 headersCVE-2022-25763Fix available7.5 High
- apache traffic server, debian linux, fedoraproject fedora +2 moreHTTP/2 framing vulnerabilitiesCVE-2022-31780Fix available7.5 High
- apache traffic server, debian linux +1 moreTransfer-Encoding not treated as hop-by-hopCVE-2022-31778Fix available7.5 High
- apache traffic server, debian linux, fedoraproject fedora +2 moreInsufficient Validation of HTTP/1.x HeadersCVE-2022-28129Fix available7.5 High
- apache traffic server, debian linux, fedoraproject fedora +2 moreProtocol vs scheme mismatchCVE-2021-37150Fix available7.5 High
- apache avroInteger overflow when reading corrupted .avro file in Avro Rust SDKCVE-2022-36125Fix available7.5 High
- apache avroMemory overconsumption in Avro Rust SDKCVE-2022-36124Fix available7.5 High
- apache avroDenial of service while reading data in Avro Rust SDKCVE-2022-35724Fix available7.5 High
- apache hadoopCommand injection in org.apache.hadoop.fs.FileUtil.unTarUsingTarCVE-2022-25168Fix available9.8 Critical
- apache jspwikiUser Group Privilege EscalationCVE-2022-34158Fix available8.8 High
- apache jspwikiApache JSPWiki Cross-site scripting vulnerability on WeblogPluginCVE-2022-28732Fix availableEPSS 82.8%6.1 Medium
- apache jspwikiApache JSPWiki CSRF in UserPreferences.jspCVE-2022-28731Fix availableEPSS 58.7%6.5 Medium
- apache jspwikiApache JSPWiki Cross-site scripting vulnerability on AJAXPreview.jspCVE-2022-28730Fix availableEPSS 86.2%6.1 Medium
- apache jspwikiXSS vulnerability on XHRHtml2Markup.jsp in JSPWiki 2.11.2CVE-2022-27166Fix availableEPSS 86.2%6.1 Medium
- apache calcite avaticaApache Calcite Avatica JDBC driver `httpclient_impl` connection property can be used as an RCE vectorCVE-2022-36364Fix available8.8 High
- apache mxnetReDoS in Apache MXNet RTC ModuleCVE-2022-24294Fix available7.5 High
- oracle jdk, openjdk, apache xalan-java +14 more +16 moreApache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheetsCVE-2022-34169Public exploitFix availableEPSS 81.8%7.5 High
- apache cloudstackApache CloudStack SAML Single Sign-On XXECVE-2022-357419.8 Critical
- apache skywalking nodejs agentService unavailability impact in NodeJS agent(version <= 0.5.0)CVE-2022-36127Fix available7.5 High
- apache sparkApache Spark shell command injection vulnerability via Spark UICVE-2022-33891In KEVPublic exploitFix availableEPSS 93.2%8.8 High
- apache hiveApache Hive Security vulnerability in Hive with UDFsCVE-2021-34538Fix available7.5 High
- apache tapestryRegular Expression Denial of Service (ReDoS) in ContentType.java. (GHSL-2022-022)CVE-2022-31781Fix available7.5 High
- apache druidClickjacking in the web consoleCVE-2022-28889Fix available4.3 Medium
- apache druidReflected XSS on certain HTTP endpointsCVE-2021-44791Fix available6.1 Medium
- apache supersetImproper access to dataset metadata informationCVE-2021-37839Fix available4.3 Medium
- apache jetspeed, portals jetspeed, apache software foundation portals +2 moreApache Portals Jetspeed XSS, CSRF, SSRF, and XXE issuesCVE-2022-325339.8 Critical
- Show moreLoading…