Skip to contentApache vulnerabilities
Products
Show 140 moreShow less
Newest
- apache http serverApache HTTP Server: SSRF with mod_rewrite in server/vhost context on WindowsCVE-2024-40898Public exploitFix available7.5 High
- apache streamparkApache StreamPark: Information leakage vulnerabilityCVE-2024-29120Fix available5.9 Medium
- apache streampipesApache StreamPipes: Potential remote code execution (RCE) via file uploadCVE-2024-31411Fix available8.8 High
- apache streampipesApache StreamPipes: Possibility of SSRF in pipeline element installation processCVE-2024-31979Fix available4.3 Medium
- apache streampipesApache StreamPipes: Potential creation of multiple identical accountsCVE-2024-30471Fix available3.7 Low
- apache streampark, apache software foundation streampark (incubating) +1 moreApache StreamPark (incubating): maven build params could trigger remote command executionCVE-2024-29737Fix available4.7 Medium
- apache streampark, apache software foundation streampark (incubating) +1 moreApache StreamPark (incubating): Unchecked maven build params could trigger remote command executionCVE-2023-52291Fix available4.7 Medium
- apache airflowApache Airflow: DAG Author Code Execution possibility in airflow-schedulerCVE-2024-39877Fix available8.8 High
- apache airflowApache Airflow: Potential XSS VulnerabilityCVE-2024-39863Fix available5.4 Medium
- apache http serverApache HTTP Server: source code disclosure with handlers configured via AddTypeCVE-2024-40725Public exploitFix available5.3 Medium
- apache supersetApache Superset: Improper SQL authorisation, parse not checking for specific engine functionsCVE-2024-39887Fix available4.3 Medium
- apache streampark, apache software foundation streampark (incubating) +1 moreApache StreamPark (incubating): Unchecked SQL query fields trigger SQL injection vulnerabilityCVE-2023-522908.1 High
- apache linkis, apache software foundation linkis datasource +1 moreApache Linkis DataSource: JDBC Datasource Module with DB2 has JNDI Injection vulnerabilityCVE-2023-49566Fix available8.8 High
- apache linkis, apache software foundation linkis datasource +1 moreApache Linkis DataSource: DataSource Remote code execution vulnerabilityCVE-2023-46801Fix available8.8 High
- apache linkis, apache software foundation linkis datasource +1 moreApache Linkis DataSource: DatasourceManager module has a JDBC parameter judgment logic vulnerability that allows for arbitrary file readingCVE-2023-41916Fix available6.5 Medium
- apache wicketApache Wicket: Remote code execution via XSLT injectionCVE-2024-36522Fix available9.8 Critical
- apache nifiApache NiFi: Improper Neutralization of Input in Parameter Context DescriptionCVE-2024-37389Fix availableEPSS 24.0%4.6 Medium
- apache cloudstackApache CloudStack: Unauthenticated cluster service port leads to remote executionCVE-2024-383469.8 Critical
- apache cloudstackApache CloudStack: Integration API service uses dynamic port when disabledCVE-2024-398649.8 Critical
- apache http server, netapp ontap tools +1 moreApache HTTP Server: source code disclosure with handlers configured via AddTypeCVE-2024-39884Fix available6.2 Medium
- apache tomcat, netapp ontap tools +1 moreApache Tomcat: HTTP/2 excess header handling DoSCVE-2024-34750Fix available7.5 High
- apache http server, netapp ontap +1 moreApache HTTP Server: mod_rewrite proxy handler substitutionCVE-2024-39573Fix availableEPSS 35.4%7.5 High
- apache http server, netapp clustered data ontap +1 moreApache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious requestCVE-2024-38477Fix available7.5 High
- apache http server, netapp clustered data ontap +1 moreApache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirectCVE-2024-38476Public exploitFix availableEPSS 41.6%9.8 Critical
- apache http server, netapp ontap 9, sonicwall sma 200 firmware +4 more +6 moreApache HTTP Server weakness in mod_rewrite when first segment of substitution matches filesystem path.CVE-2024-38475In KEVPublic exploitFix availableEPSS 100.0%9.1 Critical
- apache http server, netapp clustered data ontap +1 moreApache HTTP Server weakness with encoded question marks in backreferencesCVE-2024-38474Fix available9.8 Critical
- apache http server, netapp ontap +1 moreApache HTTP Server proxy encoding problemCVE-2024-38473Public exploitFix availableEPSS 25.9%8.1 High
- apache http server, netapp ontap +1 moreApache HTTP Server on WIndows UNC SSRFCVE-2024-38472Public exploitFix availableEPSS 69.5%7.5 High
- apache http server, netapp ontap +1 moreApache HTTP Server: DoS by Null pointer in websocket over HTTP/2CVE-2024-36387Fix available5.4 Medium
- apache streampipesApache StreamPipes, Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token GenerationCVE-2024-29868Public exploitFix available9.1 Critical
- apache jspwikiApache JSPWiki: Cross-site scripting vulnerability on upload pageCVE-2024-27136Fix availableEPSS 60.8%6.1 Medium
- apache alluraApache Allura: Stored authenticated XSSCVE-2024-383794.8 Medium
- apache supersetApache Superset: Server arbitrary file readCVE-2024-34693Public exploitFix available6.8 Medium
- apache airflowApache Airflow: Cache Control - Storage of Sensitive Data in Browser CacheCVE-2024-25142Fix available5.5 Medium
- apache submarine, apache software foundation submarine server core +1 moreApache Submarine Server Core: authorization bypassCVE-2024-362659.8 Critical
- apache submarine, apache software foundation submarine commons utils +1 moreApache Submarine Commons Utils: default secretCVE-2024-362649.8 Critical
- apache submarine, apache software foundation submarine server core +1 moreApache Submarine Server Core: SQL injectionCVE-2024-362638.1 High
- apache alluraApache Allura: sensitive information exposure via DNS rebindingCVE-2024-364717.5 High
- apache ofbizApache OFBiz: Path traversal leading to a RCECVE-2024-36104Public exploitEPSS 87.9%9.1 Critical
- apache airflowApache Airflow: XSS vulnerability in Task Instance Log/Log DetailsCVE-2024-32077Fix available5.4 Medium
- apache karaf caveApache Karaf Cave: Cave SSRF and arbitrary file accessCVE-2024-343659.1 Critical
- apache inlongApache Inlong JDBC VulnerabilityCVE-2024-26579Fix available9.8 Critical
- apache ofbizApache OFBiz: Path traversal leading to RCECVE-2024-32113In KEVPublic exploitEPSS 99.9%9.8 Critical
- apache supersetApache Superset: Incorrect datasource authorization on explore REST APICVE-2024-28148Fix available4.3 Medium
- apache hiveApache Hive: Arbitrary command execution via JDBC driverCVE-2023-35701Fix available6.6 Medium
- apache apisixApache APISIX: Forward-Auth Request SmugglingCVE-2024-32638Fix available6.3 Medium
- apache activemqApache ActiveMQ: Jolokia and REST API were not secured with default configurationCVE-2024-32114Public exploitFix available8.5 High
- apache hugegraph, hugegraph-server +1 moreApache HugeGraph-Server: Bypass whitelist in Auth modeCVE-2024-27349Fix available9.1 Critical
- apache hugegraph, hugegraph-server +1 moreApache HugeGraph-Server: Command execution in gremlinCVE-2024-27348In KEVPublic exploitFix availableEPSS 99.2%9.8 Critical
- apache hugegraph-hubbleApache HugeGraph-Hubble: SSRF in Hubble connection pageCVE-2024-27347Fix available5.3 Medium
- Show moreLoading…