Skip to contentApache vulnerabilities
Products
Show 140 moreShow less
Newest
- apache portable runtime utility, apache software foundation portable runtime utility (apr-util) +1 moreApache Portable Runtime Utility (APR-util): out-of-bounds writes in the apr_base64 family of functionsCVE-2022-25147Fix available6.5 Medium
- apache portable runtime (apr), portable runtime +1 moreApache Portable Runtime (APR): out-of-bound writes in the apr_encode family of functionsCVE-2022-24963Fix available9.8 Critical
- apache linkis, apache software foundation linkis (incubating) +1 moreApache Linkis (incubating): The DatasourceManager module has a Local File Read VulnerabilityCVE-2022-44644Fix available6.5 Medium
- apache linkis, apache software foundation linkis (incubating) +1 moreApache Linkis (incubating): The DatasourceManager module has a serialization attack vulnerabilityCVE-2022-44645Fix available8.8 High
- apache iotdb, apache software foundation iotdb workbench +1 moreApache IoTDB Workbench: apache/iotdb-web-workbench: forge the JWTToken to access workbenchCVE-2023-24829Fix available8.8 High
- apache iotdb, apache software foundation iotdb workbench +1 moreApache IoTDB Workbench: apache/iotdb-web-workbench: create a user without authorizationCVE-2023-24830Fix available7.5 High
- apache airflow, apache software foundation airflow mysql provider, apache apache-airflow-providers-mysql +2 moreApache Airflow, Apache Airflow MySQL Provider: Arbitrary file read via MySQL provider in Apache AirflowCVE-2023-22884Public exploitFix availableEPSS 11.9%9.8 Critical
- apache http serverApache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splittingCVE-2022-37436Fix availableEPSS 52.7%5.3 Medium
- apache http serverApache HTTP Server: mod_proxy_ajp Possible request smugglingCVE-2022-36760Fix available9.0 Critical
- apache http serverApache HTTP Server: mod_dav out of bounds read, or write of zero byteCVE-2006-20001Public exploitFix available7.5 High
- apache supersetApache Superset: SQL injection vulnerability in adhoc clausesCVE-2022-41703Fix available5.4 Medium
- apache supersetApache Superset: Dashboard metadata information leakCVE-2022-45438Fix available5.3 Medium
- apache supersetApache Superset: Open Redirect VulnerabilityCVE-2022-43721Fix available5.4 Medium
- apache supersetApache Superset: Improper rendering of user inputCVE-2022-43720Fix available5.4 Medium
- apache supersetApache Superset: Cross Site Request Forgery (CSRF) on accept, request access APICVE-2022-43719Fix available8.8 High
- apache supersetApache Superset: Cross-Site Scripting vulnerability on upload formsCVE-2022-43718Fix available5.4 Medium
- apache supersetApache Superset: Cross-Site Scripting on dashboardsCVE-2022-43717Fix available5.4 Medium
- apache shiro, vmware spring boot +1 moreApache Shiro before 1.11.0, when used with Spring Boot 2.6+, may allow authentication bypass through a specially crafted HTTP requestCVE-2023-22602Fix available7.5 High
- apache software foundation sling app cms, apache sling cms +1 moreApache Sling App CMS: XSS in CMS Site Group DetailCVE-2022-46769Fix available5.4 Medium
- apache james, apache software foundation james server +1 moreApache James server: Temporary File Information DisclosureCVE-2022-459355.5 Medium
- apache james, apache software foundation james mime4j +1 moreApache James MIME4J: Temporary File Information Disclosure in MIME4J TempFileStorageProviderCVE-2022-45787Fix available5.5 Medium
- apache dolphinschedulerApache DolphinScheduler: Remote command execution Vulnerability in script alert pluginCVE-2022-45875Fix available9.8 Critical
- apache tomcatApache Tomcat: JsonErrorReportValve escapingCVE-2022-45143Fix available7.5 High
- apache dubboRegular expression Denial of Service in MooToolsCVE-2021-32824Fix available9.8 Critical
- apache kylinApache Kylin: Command injection by Diagnosis ControllerCVE-2022-44621Fix available9.8 Critical
- apache kylinApache Kylin: Command injection by Useless configurationCVE-2022-43396Fix availableEPSS 55.3%8.8 High
- apache shardingsphere, apache software foundation shardingsphere-proxy +1 moreApache ShardingSphere-Proxy: MySQL authentication bypassCVE-2022-45347Fix available9.8 Critical
- apache karafApache Karaf: JDBC JAAS LDAP injectionCVE-2022-40145Fix available9.8 Critical
- apache software foundation airflow hive provider, apache apache-airflow-providers-apache-hive +1 moreApache Airflow Hive Provider: Hive Provider RCE vulnerability with hive_cli_paramsCVE-2022-46421Fix available9.8 Critical
- apache traffic serverApache Traffic Server: Security issues with the xdebug pluginCVE-2022-40743Fix available6.1 Medium
- apache traffic serverApache Traffic Server: Improperly reading the client requestsCVE-2022-37392Fix available5.3 Medium
- apache traffic serverApache Traffic Server: Improperly handled requests can cause crashes in specific pluginsCVE-2022-32749Fix available7.5 High
- apache helixApache Helix: Open redirectCVE-2022-47500Fix available6.1 Medium
- apache zeppelinApache Zeppelin: Stored XSS in note permissionsCVE-2022-46870Fix available5.4 Medium
- apache zeppelinApache Zeppelin: Arbitrary file deletion vulnerabilityCVE-2021-28655Fix available6.5 Medium
- apache bookkeeperApache BookKeeper: Java Client Uses Connection to Host that Failed Hostname VerificationCVE-2022-32531Fix available5.9 Medium
- apache atlasApache Atlas: zip path traversal in import functionalityCVE-2022-34271Fix available8.8 High
- apache cxfApache CXF SSRF VulnerabilityCVE-2022-46364Public exploitFix available9.8 Critical
- apache cxfApache CXF directory listing / code exfiltrationCVE-2022-46363Fix available7.5 High
- apache manifoldcfApache ManifoldCF: LDAP Injection Vulnerability - ActiveDirectory AuthoritiesCVE-2022-459105.3 Medium
- apache commons net, debian linux +1 moreApache Commons Net's FTP client trusts the host from PASV response by defaultCVE-2021-37533Fix available6.5 Medium
- apache tapestryApache Tapestry prior to version 4 (EOL) allows RCE though deserialization of untrusted inputCVE-2022-46366Fix available9.8 Critical
- apache fineractApache Fineract allowed an authenticated user to perform remote code execution due to path traversalCVE-2022-44635EPSS 68.8%8.8 High
- apache dolphinschedulerApache DolphinScheduler config file read by task riskCVE-2022-26885Fix available7.5 High
- apache dolphinschedulerApache DolphinScheduler prior to 2.0.5 have command execution vulnerabilityCVE-2022-45462Fix available9.8 Critical
- apache airflow, apache software foundation airflow hive provider, apache apache-airflow-providers-apache-hive +2 moreApache Airflow Hive Provider vulnerability (command injection via hive_cli connection)CVE-2022-41131Fix available7.8 High
- apache airflow, apache software foundation airflow spark provider, apache apache-airflow-providers-apache-spark +2 moreApache Airflow Spark Provider RCE that bypass restrictions to read arbitrary filesCVE-2022-40954Fix available5.5 Medium
- apache airflow, apache software foundation airlfow pig provider, apache apache-airflow-providers-apache-pig +2 moreApache Airlfow Pig Provider RCECVE-2022-40189Fix available9.8 Critical
- apache airflow, apache software foundation airflow pinot provider, apache apache-airflow-providers-apache-pinot +2 moreApache Airflow Pinot provider allowed Command InjectionCVE-2022-38649Fix available9.8 Critical
- apache hamaApache Hama allows XSS and information disclosureCVE-2022-454707.5 High
- Show moreLoading…