Skip to contentApache vulnerabilities
Products
Show 140 moreShow less
Newest
- apache sshd, apache software foundation mina sshd +1 moreApache MINA SSHD: Java unsafe deserialization vulnerabilityCVE-2022-45047Public exploitFix available9.8 Critical
- apache airflowApache Airflow: Open redirect during loginCVE-2022-45402Fix availableEPSS 81.1%6.1 Medium
- apache archivaApache Archiva prior to 2.2.9 allows an authenticated user to delete arbitrary directoriesCVE-2022-40309Fix available4.3 Medium
- apache archivaApache Archiva prior to 2.2.9 may allow the anonymous user to read arbitrary filesCVE-2022-40308Fix available7.5 High
- apache soapApache SOAP allows unauthenticated users to potentially invoke arbitrary codeCVE-2022-453789.8 Critical
- apache jena sdbApache Jena SDB allows arbitrary deserialisation via JDBCCVE-2022-45136Fix available9.8 Critical
- apache airflowApache Airflow <2.4.0 has an RCE in a bash exampleCVE-2022-40127Public exploitFix availableEPSS 85.7%8.8 High
- apache airflowApache Airflow prior to 2.3.1 may include sensitive values in rendered templateCVE-2022-27949Fix available7.5 High
- apache commons bcel, fedoraproject fedora +1 moreApache Commons BCEL prior to 6.6.0 allows producing arbitrary bytecode via out-of-bounds writingCVE-2022-42920Fix available9.8 Critical
- apache ivyApache Ivy allows path traversal in the presence of a malicious repositoryCVE-2022-37866Fix available7.5 High
- apache ivyApache Ivy allows creating/overwriting any file on the systemCVE-2022-37865Fix available9.1 Critical
- apache pulsarApache Pulsar C++/Python OAuth Clients prior to 3.0.0 were vulnerable to an MITM attack due to Disabled Certificate ValidationCVE-2022-33684Fix available8.1 High
- apache software foundation uima, apache uimaj +1 moreApache UIMA prior to 3.3.1 has a path traversal vulnerability when extracting (PEAR) archivesCVE-2022-32287Public exploitFix available7.5 High
- apache airflowApache Airflow prior to 2.4.2 has an open redirectCVE-2022-43985Fix available6.1 Medium
- apache airflowApache Airflow prior to 2.4.2 allows reflected XSS via Origin Query Argument in URLCVE-2022-43982Fix available6.1 Medium
- apache sling cms, apache software foundation sling app cms +1 moreXSS in Sling CMS Reference App Taxonomy PathCVE-2022-43670Fix available5.4 Medium
- apache tomcatApache Tomcat request smuggling via malformed content-lengthCVE-2022-42252Fix available7.5 High
- apache dolphinschedulerApache DolphinScheduler prior to 3.0.0 allows path traversalCVE-2022-34662Public exploitFix available6.5 Medium
- apache sparkApache Spark XSS vulnerability in log viewer UI JavascriptCVE-2022-31777Fix available5.4 Medium
- apache dolphinschedulerApache DolphinScheduler exposes files without authenticationCVE-2022-26884Public exploitFix available6.5 Medium
- apache iotdbApache IoTDB prior to 0.13.3 allows DoSCVE-2022-43766Fix available7.5 High
- apache flumeApache Flume prior to 1.11.0 has an Improper Input Validation (JNDI Injection) in JMSSourceCVE-2022-42468Fix available9.8 Critical
- apache linkisThe Apache Linkis JDBC EngineConn module has a RCE VulnerabilityCVE-2022-39944Fix available8.8 High
- apache batik, apache software foundation xml graphics, debian linux +2 moreApache Batik prior to 1.16 allows RCE via scriptingCVE-2022-42890Fix available7.5 High
- apache batik, apache software foundation xml graphics, debian linux +2 moreApache Batik prior to 1.16 allows RCE when loading untrusted SVG inputCVE-2022-41704Fix available7.5 High
- apache geodeApache Geode stored Cross-Site Scripting (XSS) via data injection vulnerability in Pulse web applicationCVE-2022-34870Fix available5.4 Medium
- apache heron, apache software foundation heron (incubating) +1 moreCRLF log injectionCVE-2021-42010Fix available9.8 Critical
- apache isish2 webconsole (available only in prototype mode) should nevertheless be disabled by default.CVE-2022-42467Fix available5.3 Medium
- apache isisXSS vulnerability, eg for String properties.CVE-2022-42466Fix available6.1 Medium
- apache dubboApache Dubbo Hession Deserialization Vulnerability Gadgets BypassCVE-2022-39198Fix available9.8 Critical
- apache commons text, juniper security threat response manager, netapp bluexp +2 moreApache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaultsCVE-2022-42889Public exploitFix availableEPSS 99.9%9.8 Critical
- apache kylinApache Kylin prior to 4.0.2 allows command injection when the configuration overwrites function overwrites system parametersCVE-2022-24697Fix availableEPSS 84.8%9.8 Critical
- apache shiroAuthentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcherCVE-2022-40664Fix available9.8 Critical
- apache airflowSession still functional after user is deactivatedCVE-2022-41672Fix available8.1 High
- jxpath, apache commons jxpath +1 moreStack Overflow in JXPathCVE-2022-401606.5 Medium
- jxpath, apache commons jxpath +1 moreStack Overflow in JXPathCVE-2022-401596.5 Medium
- apache tomcat, debian linux +1 moreApache Tomcat: Information disclosureCVE-2021-43980Fix available3.7 Low
- apache pulsarDisabled Certificate Validation makes Broker, Proxy Admin Clients vulnerable to MITM attackCVE-2022-33683Fix available5.9 Medium
- apache pulsarDisabled Hostname Verification makes Brokers, Proxies vulnerable to MITM attackCVE-2022-33682Fix available5.9 Medium
- apache pulsarImproper Hostname Verification in Java Client and Proxy can expose authentication data via MITMCVE-2022-33681Fix available5.9 Medium
- apache pulsarApache Pulsar Proxy target broker address isn't validatedCVE-2022-24280Fix available6.5 Medium
- apache pinotPinot query endpoint and the realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function supportCVE-2022-26112Fix available9.8 Critical
- apache soapApache SOAP: XML External Entity Injection (XXE) allows unauthenticated users to read arbitrary files via HTTPCVE-2022-407057.5 High
- apache batik, apache software foundation xml graphics, debian linux +2 moreJar url should be blocked by DefaultScriptSecurityCVE-2022-40146Public exploitFix available7.5 High
- apache batik, apache software foundation xml graphics, debian linux +2 morePDFTranscoder does not block external resourcesCVE-2022-38648Fix available5.3 Medium
- apache batik, apache software foundation xml graphics, debian linux +2 moreServer-Side Request Forgery Information Disclosure VulnerabilityCVE-2022-38398Fix available5.3 Medium
- apache airflowOpen RedirectCVE-2022-40754Fix available6.1 Medium
- apache airflowFormat String VulnerabilityCVE-2022-40604Fix available7.5 High
- apache inlongDeserialization attack in Apache InLong prior to version 1.3.0 allows RCE via JDBCCVE-2022-40955Fix available8.8 High
- apache kafkaUnauthenticated clients may cause OutOfMemoryError on Apache Kafka BrokersCVE-2022-34917Fix available7.5 High
- Show moreLoading…