Skip to contentApache vulnerabilities
Products
Show 140 moreShow less
Newest
- apache supersetApache Superset: Possible SSRF on import datasetsCVE-2023-25504Fix available4.9 Medium
- apache supersetApache Superset: Incorrect default permissions for Gamma roleCVE-2023-27525Fix available3.1 Low
- apache sparkApache Spark proxy-user privilege escalation from malicious configuration classCVE-2023-22946Fix available6.4 Medium
- apache iotdb, apache software foundation iotdb workbench, apache iotdb web workbench +2 moreApache IoTDB Workbench: apache/iotdb-web-workbench: forge the JWTToken to access workbenchCVE-2023-307719.8 Critical
- apache iotdbApache IoTDB grafana-connector Login Bypass VulnerabilityCVE-2023-24831Fix available9.8 Critical
- apache ofbizApache OFBiz: Arbitrary file reading vulnerabilityCVE-2022-47501EPSS 10.2%7.5 High
- apache sling engine, sling +1 moreApache Sling Engine: Include-based XSSCVE-2022-45064Fix available8.0 High
- apache inlongApache InLong: SQL injection in apache inLong 1.5.0CVE-2023-30465Fix available5.3 Medium
- apache linkisApache Linkis DatasourceManager module has a deserialization command executionCVE-2023-29216Fix available9.8 Critical
- apache linkisApache Linkis gateway module token authentication bypassCVE-2023-27987Fix available9.1 Critical
- apache linkisApache Linkis Mangaer module engineConn material upload exists Zip Slip issueCVE-2023-27603Fix available9.8 Critical
- apache linkisApache Linkis publicsercice module unrestricted upload of fileCVE-2023-27602Fix available9.8 Critical
- apache linkisApache Linkis JDBC EngineCon has a deserialization command executionCVE-2023-29215Fix available9.8 Critical
- apache software foundation airflow spark provider, apache apache-airflow-providers-apache-spark +1 moreApache Airflow Spark Provider Arbitrary File Read via JDBCCVE-2023-28710Fix available7.5 High
- apache airflow hive providerApache Airflow Hive Provider Beeline Remote Command ExecutionCVE-2023-28706Fix available9.8 Critical
- apache software foundation airflow drill provider, apache apache-airflow-providers-apache-drill +1 moreAirflow Apache Drill Provider Arbitrary File Read VulnerabilityCVE-2023-28707Fix available7.5 High
- apache james, james server +1 moreApache James server: Privilege escalation through unauthenticated JMXCVE-2023-26269Public exploitFix available7.8 High
- apache software foundation uima ducc, apache unstructured information management architecture +1 moreApache UIMA DUCC: DUCC (EOL) allows RCECVE-2023-289358.8 High
- apache archivaApache Archiva privilege escalationCVE-2023-28158Fix available6.5 Medium
- apache openmeetingsApache OpenMeetings: allows user impersonationCVE-2023-28326Fix available9.8 Critical
- apache fineractapache fineract: SQL injection vulnerability in certain procedure callsCVE-2023-251976.3 Medium
- apache fineractApache Fineract: SQL injection vulnerabilityCVE-2023-251964.3 Medium
- apache fineractApache Fineract: SSRF template type vulnerability in certain authenticated usersCVE-2023-251958.1 High
- apache inlongApache InLong: JDBC Deserialization Vulnerability in InLongCVE-2023-27296Fix available8.8 High
- apache openofficeApache OpenOffice: Macro URL arbitrary script executionCVE-2022-475027.8 High
- apache openofficeApache OpenOffice: Empty entry in Java class pathCVE-2022-38745Fix available7.8 High
- apache tomcatApache Tomcat: JSESSIONID Cookie missing secure attribute in some configurationsCVE-2023-28708Fix available4.3 Medium
- apache sling resource mergerApache Sling Resource Merger: Requests to certain paths managed by the Apache Sling Resource Merger can lead to DoSCVE-2023-26513Fix available7.5 High
- apache airflowInformation disclosure in Apache AirflowCVE-2023-25695Fix available5.3 Medium
- apache log4jApache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppenderCVE-2023-26464Fix available7.5 High
- apache dubboApache Dubbo Deserialization Vulnerability Gadgets BypassCVE-2023-23638Public exploitFix available5.0 Medium
- apache http server, unbit uwsgi, debian linux +2 moreApache HTTP Server: mod_proxy_uwsgi HTTP response splittingCVE-2023-27522Fix available7.5 High
- apache http serverApache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxyCVE-2023-25690Public exploitFix availableEPSS 84.0%9.8 Critical
- apache software foundation airflow aws provider, apache apache-airflow-providers-amazon +1 moreApache Airflow AWS Provider: Arbitrary file read via AWS providerCVE-2023-25956Fix available7.5 High
- apache software foundation airflow hive provider, apache apache-airflow-providers-apache-hive +1 moreApache Airflow Hive Provider Beeline RCECVE-2023-25696Fix available9.8 Critical
- apache software foundation airflow sqoop provider, apache apache-airflow-providers-apache-sqoop +1 moreSqoop Apache Airflow Provider Remote Code Execution VulnerabilityCVE-2023-25693Fix available9.8 Critical
- apache software foundation airflow google provider, apache apache-airflow-providers-google +1 moreApache Airflow Google Provider: Google Cloud Sql Provider Denial Of ServiceCVE-2023-25692Fix available7.5 High
- apache software foundation airflow google provider, apache apache-airflow-providers-google +1 moreApache Airflow Google Provider: Google Cloud Sql Provider Remote Command ExecutionCVE-2023-25691Fix available9.8 Critical
- apache software foundation sling, apache sling i18n +1 moreApache Sling does not allow to handle i18n content in a secure wayCVE-2023-25621Fix available6.5 Medium
- apache commons fileupload, apache software foundation tomcat, debian linux +2 moreApache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive partsCVE-2023-24998Public exploitFix availableEPSS 48.8%7.5 High
- apache kerby ldap backendLDAP Injection Vulnerability in Apache KerbyCVE-2023-25613Fix available9.8 Critical
- apache shenyuApache ShenYu Admin ultra viresCVE-2022-42735Fix available8.8 High
- apache sling jcr baseJNDI injection into Apache sling-org-apache-sling-jcr-baseCVE-2023-25141Fix available7.5 High
- apache nifiApache NiFi: Improper Restriction of XML External Entity References in ExtractCCDAAttributesCVE-2023-22832Fix available7.5 High
- apache kafka connect, apache software foundation kafka connect api +1 moreApache Kafka Connect API: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration using Kafka ConnectCVE-2023-25194Public exploitFix availableEPSS 95.8%8.8 High
- apache ageApache AGE: Python and Golang drivers allow data manipulation and exposure due to SQL injectionCVE-2022-45786Fix available8.1 High
- apache software foundation sling app cms, apache sling cms +1 moreApache Sling App CMS: XSS in CMS Reference / UI ComponentsCVE-2023-22849Fix available6.1 Medium
- apache inlongApache InLong: Jdbc Connection Security BypassCVE-2023-249979.8 Critical
- apache inlongApache InLong: Jdbc Connection causes arbitrary file reading in InLongCVE-2023-249777.5 High
- apache portable runtime (apr), portable runtime +1 moreApache Portable Runtime (APR): Windows out-of-bounds write in apr_socket_sendv functionCVE-2022-28331Fix available9.8 Critical
- Show moreLoading…