Skip to contentApache vulnerabilities
Products
Show 140 moreShow less
Newest
- apache tomcatApache Tomcat: Leaking of unrelated request bodies in default error pageCVE-2024-21733Public exploitFix availableEPSS 14.3%5.3 Medium
- apache iotdbApache IoTDB: Remote Code Execution (RCE) risk via the UDFCVE-2023-46226Fix available9.8 Critical
- apache shiroApache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewritingCVE-2023-46749Fix available6.5 Medium
- apache solrApache Solr: Host environment variables are published via the Metrics APICVE-2023-50290Public exploitFix availableEPSS 68.4%6.5 Medium
- apache answerApache Answer: Repeated submissions using scripts resulted in an abnormal number of collections for questions.CVE-2023-49619Fix available3.1 Low
- apache axisApache Axis 1.x (EOL) may allow SSRF when untrusted input is passed to the service admin HTTP APICVE-2023-51441Fix available7.2 High
- apache inlongApache InLong: Remote Code Execution vulnerability in Apache InLong ManagerCVE-2023-51784Fix available9.8 Critical
- apache inlongApache InLong: Arbitrary File Read Vulnerability in Apache InLong ManagerCVE-2023-51785Fix available7.5 High
- apache dolphinschedulerApache DolphinScheduler: Arbitrary js execute as root for authenticated usersCVE-2023-49299Fix available8.8 High
- apache openofficeApache OpenOffice: Macro URL arbitrary script executionCVE-2023-478048.8 High
- apache ofbizApache OFBiz: Pre-authentication Remote Code Execution (RCE) vulnerabilityCVE-2023-51467Public exploitEPSS 96.0%9.8 Critical
- apache ofbizApache OFBiz: Arbitrary file properties reading and SSRF attackCVE-2023-50968EPSS 63.4%7.5 High
- apache hertzbeatUnauthorized access vulnerability on three interfacesCVE-2023-516507.5 High
- apache hertzbeatExpression Injection Vulnerability in HertzbeatCVE-2023-513877.2 High
- apache hertzbeatPermission bypass due to incorrect configuration in github.com/dromara/hertzbeatCVE-2022-393377.5 High
- apache iotdbApache IoTDB: Unsafe deserialize map in Sync ToolCVE-2023-51656Fix available9.8 Critical
- apache airflowApache Airflow: Improper access control to DAG resourcesCVE-2023-48291Fix available4.3 Medium
- apache airflowApache Airflow: Improper access control vulnerability on the "varimport" endpointCVE-2023-50783Fix available6.5 Medium
- apache airflowApache Airflow: DAG Params alllow to embed unchecked JavascriptCVE-2023-47265Fix available5.4 Medium
- apache airflowApache Airflow: Missing CSRF protection on DAG/triggerCVE-2023-49920Fix available6.5 Medium
- apache pulsar, apache software foundation pulsar websocket proxy +1 moreApache Pulsar WebSocket Proxy: Improper Authentication for WebSocket Proxy Endpoint Allows DoSCVE-2023-37544Fix available7.5 High
- apache guacamoleApache Guacamole: Integer overflow in handling of VNC image buffersCVE-2023-43826Fix available7.5 High
- apache supersetApache Superset: Privilege Escalation VulnerabilityCVE-2023-49734Fix available7.7 High
- apache supersetApache Superset: SQL Injection on where_in JINJA macroCVE-2023-49736Fix available6.5 Medium
- apache supersetApache Superset: Allows for uncontrolled resource consumption via a ZIP bombCVE-2023-46104Fix available6.5 Medium
- apache dorisApache Doris: Missing API authentication allowed DoSCVE-2023-413148.2 High
- 9bis kitty, apache sshd, sshj +68 more +70 morePrefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka TerrapinCVE-2023-48795Public exploitFix availableEPSS 93.5%5.9 Medium
- apache streampark, apache software foundation streampark (incubating) +1 moreApache StreamPark (incubating): Authenticated system users could trigger SQL injection vulnerabilityCVE-2023-30867Fix available4.9 Medium
- apache streampark, apache software foundation streampark (incubating) +1 moreApache StreamPark (incubating): Authenticated system users could trigger remote command executionCVE-2023-49898Fix available7.2 High
- apache dubboApache Dubbo: Bypass deny serialize list check in Apache DubboCVE-2023-46279Fix available9.8 Critical
- apache dubboBypass serialize checks in Apache DubboCVE-2023-29234Fix available9.8 Critical
- apache shiroApache Shiro: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Shiro.CVE-2023-46750Fix available6.1 Medium
- apache couchdb, apache software foundation ibm cloudant +1 moreApache CouchDB, IBM Cloudant: Privilege Escalation Using _design DocumentsCVE-2023-45725Fix available5.7 Medium
- apache strutsApache Struts: File upload component had a directory traversal vulnerabilityCVE-2023-50164Public exploitFix availableEPSS 80.8%9.8 Critical
- apache strutsApache Struts: excessive disk usageCVE-2023-41835Fix available7.5 High
- apache ofbizPre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still presentCVE-2023-49070Public exploitEPSS 95.4%9.8 Critical
- apache tilesApache Tiles: Unvalidated input may lead to path traversal and XXECVE-2023-497357.5 High
- apache cocoonApache Cocoon's StreamGenerator is vulnerable to XXE injectionCVE-2023-49733Fix available9.8 Critical
- apache dolphinschedulerApache DolphinScheduler: Authenticated users could delete UDFs in resource center they were not authorized forCVE-2023-49620Fix available6.5 Medium
- apache cocoonApache Cocoon: SQL injection in DatabaseCookieAuthenticatorActionCVE-2022-45135Fix available9.8 Critical
- apache supersetApache Superset: Lack of rate limiting allows for possible denial of serviceCVE-2023-42504Fix available5.8 Medium
- apache supersetApache Superset: Sensitive information disclosure on db connection detailsCVE-2023-42505Fix available4.3 Medium
- apache supersetApache Superset: Open Redirect VulnerabilityCVE-2023-42502Fix available4.8 Medium
- apache tomcatApache Tomcat: HTTP request smuggling via malformed trailer headersCVE-2023-46589Fix available7.5 High
- apache activemqApache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCECVE-2022-41678Public exploitFix availableEPSS 85.7%8.8 High
- apache nifiApache NiFi: Improper Neutralization of Input in Advanced User Interface for JoltCVE-2023-49145Fix available7.9 High
- apache supersetApache Superset: Stored XSS on API endpointCVE-2023-43701Fix available4.3 Medium
- apache supersetApache Superset: Unnecessary read permissions within the Gamma roleCVE-2023-42501Fix available4.3 Medium
- apache supersetApache Superset: Privilege escalation with default examples databaseCVE-2023-40610Fix available6.3 Medium
- apache dolphinschedulerApache DolphinScheduler: Information Leakage VulnerabilityCVE-2023-49068Fix available7.5 High
- Show moreLoading…