Skip to contentApache vulnerabilities
Products
Show 140 moreShow less
Newest
- apache supersetApache Superset: Improper API permission for low privilege usersCVE-2023-36387Fix available5.4 Medium
- apache axisApache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getServiceCVE-2023-40743Fix available9.8 Critical
- apache software foundation nifi minifi c++, apache nifi minifi c\+\+ +1 moreApache NiFi MiNiFi C++: Incorrect Certificate Validation in InvokeHTTP for MiNiFi C++CVE-2023-411805.9 Medium
- apache airflow spark providerApache Airflow Spark Provider Deserialization Vulnerability RCECVE-2023-40195Fix available8.8 High
- apache airflow sqoop providerApache Airflow Sqoop Provider: Airflow Sqoop Provider RCE VulnerabilityCVE-2023-27604Fix available8.8 High
- apache tomcat, debian linux +1 moreApache Tomcat: Open redirect with FORM authenticationCVE-2023-41080Public exploitFix available6.1 Medium
- apache airflow, apache software foundation airflow imap provider, airflow smtp provider +2 more +4 moreApache Airflow SMTP Provider, Apache Airflow IMAP Provider, Apache Airflow: SMTP/IMAP client components allowed MITM due to missing Certificate ValidationCVE-2023-39441Fix available5.9 Medium
- apache airflowApache Airflow: Exposure of sensitive connection information, DOS and SSRF on "test connection" featureCVE-2023-37379Fix available8.1 High
- apache airflowSession fixation in Apache Airflow web interfaceCVE-2023-40273Fix available8.0 High
- apache xml graphics batik, debian linux +1 moreApache XML Graphics Batik: Information disclosure vulnerabilityCVE-2022-44729Fix available7.1 High
- apache xml graphics batik, debian linux +1 moreApache XML Graphics Batik: Information disclosure vulnerabilityCVE-2022-44730Fix available4.4 Medium
- apache ivyApache Ivy: XML External Entity vulnerability in Apache IvyCVE-2022-46751Fix available8.2 High
- apache nifiApache NiFi: Incomplete Validation of JDBC and JNDI Connection URLsCVE-2023-40037Public exploitFix available6.5 Medium
- apache software foundation airflow spark provider, apache apache-airflow-providers-apache-drill, apache-airflow-providers-apache-spark +2 moreApache Airflow Spark Provider Arbitrary File Read via JDBCCVE-2023-40272Fix available7.5 High
- apache software foundation airflow drill provider, apache apache-airflow-providers-apache-drill +1 moreApache Airflow Drill Provider Arbitrary File Read VulnerabilityCVE-2023-39553Fix available7.5 High
- apache traffic serverApache Traffic Server: Differential fuzzing for HTTP request parsing discrepanciesCVE-2023-33934Fix available9.1 Critical
- apache traffic serverApache Traffic Server: Invalid Range header causes a crashCVE-2022-47185Fix available7.5 High
- apache rollerApache Roller: Roller's weblog category, weblog settings and file-upload features did not properly sanitize input could be exploited to perform Reflected Cross Site Scripting (XSS) even on a Roller si…CVE-2023-375815.4 Medium
- apache airflowApache Airflow: Airflow "Run task" feature allows execution with unnecessary priviledgesCVE-2023-39508Fix available8.8 High
- apache nifiApache NiFi: Potential Code Injection with Properties Referencing Remote ResourcesCVE-2023-36542Public exploitFix available8.8 High
- apache helixApache Helix: Deserialization vulnerability in Helix workflow and RESTCVE-2023-38647Fix available9.8 Critical
- apache software foundation felix healthcheck webconsole plugin, apache felix health check webconsole plugin +1 moreApache Felix Healthcheck Webconsole Plugin: XSS in healthcheck webconsole pluginCVE-2023-38435Fix available6.1 Medium
- apache jackrabbit, apache software foundation jackrabbit standalone (jackrabbit-standalone and jackrabbit-standalone-components), jackrabbit webapp (jackrabbit-webapp) +2 moreApache Jackrabbit RMI access can lead to RCECVE-2023-37895Fix available9.8 Critical
- apache inlongApache InLong: SQL injection in audit endpointCVE-2023-35088Fix available9.8 Critical
- apache inlongApache InLong: JDBC URL bypassing by allowLoadLocalInfileInPath paramCVE-2023-34434Fix available7.5 High
- apache inlongApache InLong: General user can delete and update processCVE-2023-34189Fix available6.5 Medium
- apache shiroApache Shiro before 1.12.0, or 2.0.0-alpha-3, may be susceptible to a path traversal attack when used together with APIs or other web frameworks that route requests based on non-normalized requests.CVE-2023-34478Public exploitFix available9.8 Critical
- apache shardingsphere, apache software foundation shardingsphere-agent +1 moreShardingSphere-Agent: Deserialization vulnerability in ShardingSphere AgentCVE-2023-28754Fix available8.8 High
- apache eventmesh, eventmesh-connector-rabbitmq, apache software foundation eventmesh (incubating) rabbitmq connector +2 moreApache EventMesh RabbitMQ-Connector plugin allows RCE through deserialization of untrusted dataCVE-2023-265129.8 Critical
- apache software foundation airflow apache hive provider, apache apache-airflow-providers-apache-hive +1 moreApache Airflow Apache Hive Provider: Improper Input Validation in Hive Provider with proxy_userCVE-2023-37415Fix available8.8 High
- apache ambariApache Ambari: Allows authenticated metrics consumers to perform RCECVE-2022-45855Fix available8.0 High
- apache ambariApache Ambari: A malicious authenticated user can remotely execute arbitrary code in the context of the application.CVE-2022-42009Fix available8.0 High
- apache rocketmqApache RocketMQ: Possible remote code execution when using the update configuration functionCVE-2023-37582Public exploitFix availableEPSS 90.4%9.8 Critical
- apache airflowApache Airflow: Scheduler remote DoSCVE-2023-22888Fix available6.5 Medium
- apache airflowApache Airflow: ReDoS via dags functionCVE-2023-36543Fix available6.5 Medium
- apache airflowApache Airflow: Security vulnerability on AirFlow ConnectionsCVE-2022-46651Fix available6.5 Medium
- apache airflowApache Airflow path traversal by authenticated userCVE-2023-22887Fix available6.5 Medium
- apache airflowApache Airflow: Access to DAGs without relevant permissionCVE-2023-35908Fix available6.5 Medium
- apache pulsar, apache software foundation pulsar broker +1 moreApache Pulsar Broker: Incorrect Authorization Validation for Rest ProducerCVE-2023-30428Fix available8.2 High
- apache pulsarApache Pulsar: Incorrect Authorization for Function Worker when using mTLS Authentication through Pulsar ProxyCVE-2023-30429Fix available9.6 Critical
- apache pulsarApache Pulsar: Broker does not always disconnect client when authentication data expiresCVE-2023-31007Fix available0.0 None
- apache pulsar, apache software foundation pulsar function worker +1 moreApache Pulsar Function Worker: Incorrect Authorization for Function Worker Can Leak Sink/Source CredentialsCVE-2023-37579Fix available8.2 High
- apache jenaApache Jena: Exposure of execution in script engine expressions.CVE-2023-32200Fix available8.8 High
- eclipse jetty, ietf http, http/2 +166 more +168 moreEclipse Jetty XmlParser allows arbitrary DOCTYPE declarationsCVE-2023-44487In KEVPublic exploitFix availableEPSS 100.0%7.5 High
- apache camel, apache software foundation camel jira +1 moreApache Camel JIRA: Temporary file information disclosure in Camel-JiraCVE-2023-34442Fix available3.3 Low
- apache sshd, apache software foundation mina sshd +1 moreApache MINA SSHD: Information disclosure bugs with RootedFilesystemCVE-2023-35887Public exploitFix available5.0 Medium
- apache johnzonApache Johnzon: Prevent inefficient internal conversion from BigDecimal at large scaleCVE-2023-33008Fix available5.3 Medium
- apache any23Apache Any23: Possible excessive allocation of resources reading input.CVE-2023-341506.5 Medium
- apache software foundation airflow apache hive provider, apache apache-airflow-providers-apache-hive +1 moreApache Airflow Hive Provider Beeline RCE with PrincipalCVE-2023-35797Fix available9.8 Critical
- apache software foundation airflow jdbc provider, apache apache-airflow-providers-jdbc +1 moreApache Airflow JDBC Provider: RCE VulnerabilityCVE-2023-22886Fix available8.8 High
- Show moreLoading…