Skip to contentApache vulnerabilities
Products
Show 140 moreShow less
Newest
- apache software foundation airflow mssql provider, airflow odbc provider, apache apache-airflow-providers-microsoft-mssql +1 more +3 moreAirflow Apache ODBC and MSSQL Providers Arbitrary File Read VulnerabilityCVE-2023-35798Fix available4.3 Medium
- apache software foundation airflow odbc provider, apache apache-airflow-providers-odbc +1 moreApache Airflow ODBC Provider: Remote code execution vulnerabilityCVE-2023-34395Fix available7.8 High
- apache streampipesApache StreamPipes: Privilege escalation through non-admin userCVE-2023-31469Fix available8.8 High
- apache tomcatApache Tomcat: AJP response header mix-upCVE-2023-34981Fix available7.5 High
- apache accumuloApache Accumulo: Accumulo 2.1.0 may incorrectly validate cached credentialsCVE-2023-34340Fix available9.8 Critical
- apache airflowApache Airflow: Information disclosure on configuration viewCVE-2023-35005Fix available6.5 Medium
- apache strutsApache Struts: DoS via OOM owing to no sanity limit on normal form fields in multipart formsCVE-2023-34396Fix available4.3 Medium
- apache strutsApache Struts: DoS via OOM owing to not properly checking of list boundsCVE-2023-34149Fix available4.3 Medium
- apache traffic server, debian linux, fedoraproject fedora +2 moreApache Traffic Server: Configuration option to block the PUSH method in ATS didn't workCVE-2023-30631Fix available7.5 High
- apache traffic serverApache Traffic Server: s3_auth plugin problem with hash calculationCVE-2023-33933Fix available7.5 High
- apache traffic server, debian linux +1 moreApache Traffic Server: The TRACE method can be use to disclose network informationCVE-2022-47184Fix available7.5 High
- apache nifiApache NiFi: Potential Deserialization of Untrusted Data with JNDI in JMS ComponentsCVE-2023-34212Public exploitFix available6.5 Medium
- apache nifiApache NiFi: Potential Code Injection with Database Services using H2CVE-2023-34468Public exploitFix availableEPSS 61.9%8.8 High
- apache guacamoleApache Guacamole: Use-after-free in handling of RDP audio input bufferCVE-2023-30576Fix available6.8 Medium
- apache guacamoleApache Guacamole: Incorrect calculation of Guacamole protocol element lengthsCVE-2023-30575Fix available6.5 Medium
- apache airflow cncf kubernetes, apache software foundation airflow cncf kubernetes provider, apache apache-airflow-providers-cncf-kubernetes +2 moreApache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configurationCVE-2023-33234Fix available7.2 High
- apache cassandraApache Cassandra: Privilege escalation when enabling FQL/Audit logsCVE-2023-30601Fix available7.8 High
- apache jspwikiApache JSPWiki: XSS Injection points in several pluginsCVE-2022-46907Public exploitFix available6.1 Medium
- apache rocketmqApache RocketMQ: Possible remote code execution vulnerability when using the update configuration functionCVE-2023-33246In KEVPublic exploitFix availableEPSS 96.6%9.8 Critical
- apache inlongApache InLong: Privilege escalation vulnerability for InLongCVE-2023-31062Fix available9.8 Critical
- apache inlongApache InLong: Insecurity direct object references cancelling applicationsCVE-2023-31064Fix available7.5 High
- apache inlongApache InLong: Insufficient Session Expiration in InLongCVE-2023-31065Fix available9.1 Critical
- apache inlongApache InLong: Insecure direct object references for inlong sourcesCVE-2023-31066Fix available9.1 Critical
- apache inlongApache InLong: Weak Password Implementation in InLongCVE-2023-31098Fix available9.8 Critical
- apache inlongApache InLong: Users who joined later can see the data of deleted usersCVE-2023-31101Fix available6.5 Medium
- apache inlongApache InLong: Attackers can change the immutable name and type of clusterCVE-2023-31103Fix available7.5 High
- apache inlongApache InLong: Attackers can change the immutable name and type of nodesCVE-2023-31206Fix available7.5 High
- apache inlongApache InLong: IDOR make users can delete others' subscriptionCVE-2023-31453Fix available7.5 High
- apache inlongApache InLong: IDOR make users can bind any clusterCVE-2023-31454Fix available7.5 High
- apache inlongApache InLong: JDBC URL bypassing by adding blanksCVE-2023-31058Fix available7.5 High
- apache tomcat, debian linux, netapp 7-mode transition tool +2 moreApache Tomcat: Fix for CVE-2023-24998 is incompleteCVE-2023-28709Fix availableEPSS 48.0%7.5 High
- apache sling commons json, apache software foundation org.apache.sling.commons.json +1 moreMultiple parsing problems in the Apache Sling Commons JSON moduleCVE-2022-479379.8 Critical
- apache openmeetingsApache OpenMeetings: insufficient check of invitation hashCVE-2023-28936Fix available5.3 Medium
- apache openmeetingsApache OpenMeetings: allows bypass authenticationCVE-2023-29032Fix available8.1 High
- apache openmeetingsApache OpenMeetings: allows null-byte InjectionCVE-2023-29246Fix available7.2 High
- apache airflowApache Airflow: Privilege escalation using airflow logsCVE-2023-25754Fix available9.8 Critical
- apache airflowStored XSS on Apache AirflowCVE-2023-29247Fix available5.4 Medium
- apache brpcApache bRPC: ServerOptions.pid_file may cause arbitrary code executionCVE-2023-310399.8 Critical
- apache log4cxxApache Log4cxx: SQL injection when using ODBC appenderCVE-2023-31038Fix available8.8 High
- apache ranger, apache software foundation ranger hive plugin +1 morePermissions problem in the Apache Ranger Hive PluginCVE-2021-40331Fix available8.1 High
- apache rangerApache Ranger: code execution vulnerability in policy expressionsCVE-2022-45048Fix available8.4 High
- apache couchdb, apache software foundation ibm cloudant, ibm cloudant +2 moreApache CouchDB, IBM Cloudant: Information sharing via couchjs processesCVE-2023-26268Fix available4.4 Medium
- apache sparkApache Spark: Shell command injection via Spark UICVE-2023-32007Fix availableEPSS 75.8%8.8 High
- apache streampark, apache software foundation streampark (incubating) +1 moreApache StreamPark (incubating): Logic error causing any account resetCVE-2022-46365Fix available9.1 Critical
- apache streampark, apache software foundation streampark (incubating) +1 moreApache StreamPark (incubating): LDAP Injection VulnerabilityCVE-2022-45801Fix available5.4 Medium
- apache streampark, apache software foundation streampark (incubating) +1 moreApache StreamPark (incubating): Upload any file to any directoryCVE-2022-45802Fix available9.8 Critical
- apache jenaApache Jena: Exposure of arbitrary execution in script engine expressions.CVE-2023-22665Fix available5.4 Medium
- apache supersetApache Superset: Database connection password leakCVE-2023-30776Fix available4.9 Medium
- apache supersetApache Superset: Session validation vulnerability when using provided default SECRET_KEYCVE-2023-27524In KEVPublic exploitFix availableEPSS 98.1%8.9 High
- apache dolphinschedulerApache DolphinScheduler 3.0.0 to 3.1.1 python gateway has improper authenticationCVE-2023-25601Fix available4.3 Medium
- Show moreLoading…