Skip to contentApache vulnerabilities
Products
Show 140 moreShow less
Newest
- apache ambariApache Ambari: Various XSS problemsCVE-2023-50378Fix available6.1 Medium
- apache airflowApache Airflow: Overly broad default permissions for Viewer/Ops (audit logs)CVE-2024-26280Fix available4.7 Medium
- apache airflowApache Airflow: Dag Code and Import Error Permissions IgnoredCVE-2024-27906Fix available5.9 Medium
- apache ofbizApache OFBiz: Path traversal or file inclusionCVE-2024-239465.3 Medium
- apache ofbizApache OFBiz: Path traversal allowing authentication bypass.CVE-2024-25065EPSS 47.7%9.1 Critical
- apache software foundation xerces c++, apache xerces-c, xerces-c\+\+ +2 moreApache Xerces C++: Use-after-free on external DTD scanCVE-2024-23807Fix available9.8 Critical
- apache supersetApache Superset: Improper authorization validation on dashboards and charts importCVE-2024-26016Fix available4.3 Medium
- apache supersetApache Superset: Improper data authorization when creating a new datasetCVE-2024-24779Fix available5.0 Medium
- apache supersetApache Superset: Improper Neutralisation of custom SQL on embedded contextCVE-2024-24772Fix available4.3 Medium
- apache supersetApache Superset: Improper validation of SQL statements allows for unauthorized access to dataCVE-2024-24773Fix available4.9 Medium
- apache supersetApache Superset: Improper error handling on alertsCVE-2024-27315Fix available4.3 Medium
- apache ambariApache Ambari: authenticated users could perform XXE to read arbitrary files on the serverCVE-2023-50380Fix available6.5 Medium
- apache james mime4jApache James Mime4J: Mime4J DOM header injectionCVE-2024-21742Fix available5.3 Medium
- apache auroraApache Aurora: padding oracle can allow construction an authentication cookieCVE-2024-279059.1 Critical
- apache james, apache software foundation james server +1 moreSMTP smuggling in Apache JamesCVE-2023-51747Fix available7.1 High
- apache james, james server +1 moreApache James server: Privilege escalation via JMX pre-authentication deserialisationCVE-2023-51518Public exploitFix available9.8 Critical
- apache ambariApache Ambari: authenticated users could perform command injection to perform RCECVE-2023-50379Fix available8.8 High
- apache camelApache Camel issue on ExchangeCreatedEventCVE-2024-22371Public exploitFix available2.9 Low
- apache dolphinschedulerApache DolphinScheduler: Arbitrary js execution as root for authenticated usersCVE-2024-23320Fix available8.8 High
- apache hertzbeatHertzBeat SnakeYAML Deser RCECVE-2023-513899.8 Critical
- apache hertzbeatHertzBeat AviatorScript Inject RCECVE-2023-513889.8 Critical
- apache hertzbeatHertzbeat JMX JNDI RCECVE-2023-516539.8 Critical
- apache answerApache Answer: Pixel Flood Attack by uploading the large pixel fileCVE-2024-22393Public exploitFix available9.1 Critical
- apache answerApache Answer: XSS vulnerability when submitting summaryCVE-2024-23349Fix available5.4 Medium
- apache answerApache Answer: Repeated submission at registration created duplicate users with the same nameCVE-2024-26578Fix available5.9 Medium
- apache airflow mongo provider, apache-airflow-providers-mongo +1 moreApache Airflow Mongo Provider: Certificate validation isn't respected even if SSL is enabled for apache-airflow-providers-mongoCVE-2024-25141Fix available9.1 Critical
- apache camelApache Camel: Camel-CassandraQL: Unsafe Deserialization from CassandraAggregationRepositoryCVE-2024-23114Fix available9.8 Critical
- apache camelApache Camel: Camel-SQL: Unsafe Deserialization from JDBCAggregationRepositoryCVE-2024-22369Public exploitFix available7.8 High
- apache dolphinschedulerApache DolphinScheduler: Arbitrary File Read VulnerabilityCVE-2023-51770Public exploitFix available7.5 High
- apache dolphinschedulerApache DolphinScheduler: Session do not expire after password changeCVE-2023-50270Fix available6.5 Medium
- apache dolphinschedulerApache DolphinScheduler: Insecure TLS TrustManager used in HttpUtilCVE-2023-49250Fix available7.3 High
- apache dolphinschedulerRemote Code Execution in Apache DolphinschedulerCVE-2023-49109Public exploitFix available9.8 Critical
- apache commons compressApache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP fileCVE-2024-25710Fix available8.1 High
- apache commons compressApache Commons Compress: OutOfMemoryError unpacking broken Pack200 fileCVE-2024-26308Public exploitFix available5.5 Medium
- apache supersetApache Superset: Allows for uncontrolled resource consumption via a ZIP bomb (version range fix for CVE-2023-46104)CVE-2024-23952Fix available6.5 Medium
- apache solrApache Solr: System Property redaction logic inconsistency can lead to leaked passwordsCVE-2023-50291Fix available7.5 High
- apache solrApache Solr: Solr Schema Designer blindly "trusts" all configsets, possibly leading to RCE by unauthenticated usersCVE-2023-50292Fix available7.5 High
- apache solrApache Solr: Solr can expose ZooKeeper credentials via Streaming ExpressionsCVE-2023-50298Fix available7.5 High
- apache solrApache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSetsCVE-2023-50386Public exploitFix availableEPSS 83.7%8.8 High
- apache brpcApache bRPC: HTTP request smuggling vulnerabilityCVE-2024-234527.5 High
- apache ozoneApache Ozone: Missing mutual TLS authentication in one of the service internal Ozone Storage Container Manager endpointsCVE-2023-39196Fix available5.3 Medium
- apache pulsarApache Pulsar: Timing attack in SASL token signature verificationCVE-2023-51437Fix available7.4 High
- apache sling servlets resolverApache Sling Servlets Resolver: Malicious code execution via path traversalCVE-2024-23673Public exploitFix available8.5 High
- apache servicecomb, apache software foundation servicecomb service-center +1 moreApache ServiceComb Service-Center: attacker can perform SSRF through the frontend APICVE-2023-44313Fix available7.6 High
- apache servicecomb, apache software foundation servicecomb service-center +1 moreApache ServiceComb Service-Center: attacker can query all environment variables of the service-center serverCVE-2023-44312Fix available5.8 Medium
- apache kylinApache Kylin: Insufficiently protected credentials in config fileCVE-2023-29055Fix available7.5 High
- apache airflowApache Airflow: Bypass permission verification to read code of other dagsCVE-2023-50944Fix available6.5 Medium
- apache airflowApache Airflow: Potential pickle deserialization vulnerability in XComsCVE-2023-50943Fix available7.5 High
- apache airflow, apache software foundation airflow cncf kubernetes provider, apache apache-airflow-providers-cncf-kubernetes +2 moreApache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer serviceCVE-2023-51702Fix available6.5 Medium
- apache supersetApache Superset: Stored XSS in Dashboard Title and Chart TitleCVE-2023-49657Fix available9.6 Critical
- Show moreLoading…