Skip to contentApache vulnerabilities
Products
Show 140 moreShow less
Newest
- apache supersetApache Superset: SQLLab Improper readonly query validation allows unauthorized write accessCVE-2024-55633Fix available7.1 High
- apache strutsApache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checksCVE-2024-53677Public exploitFix availableEPSS 72.4%9.5 Critical
- apache supersetApache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabledCVE-2024-53949Fix available7.6 High
- apache supersetApache Superset: Error verbosity exposes metadata in analytics databasesCVE-2024-53948Fix available5.3 Medium
- apache supersetApache Superset: Improper SQL authorisation, parse not checking for specific postgres functionsCVE-2024-53947Fix available2.3 Low
- apache subversion, debian linux +1 moreApache Subversion: mod_dav_svn denial-of-service via control characters in pathsCVE-2024-46901Fix available3.1 Low
- apache hiveApache Hive: Deserialization of untrusted data when fetching partitions from the MetastoreCVE-2022-41137Fix available8.3 High
- apache ozoneApache Ozone: Improper authentication when generating S3 secretsCVE-2024-45106Fix available8.1 High
- apache arrow, apache software foundation arrow r package +1 moreApache Arrow R package: Arbitrary code execution when loading a malicious data fileCVE-2024-52338Fix available9.8 Critical
- apache nimbleApache NimBLE: Lack of input sanitization leading to out-of-bound reads in Number of Completed Packets HCI event handlerCVE-2024-515697.5 High
- apache nimbleApache NimBLE: Lack of input validation in HCI advertising report could lead to potential out-of-bound accessCVE-2024-472505.0 Medium
- apache nimbleApache NimBLE: Lack of input sanitization leading to out-of-bound reads in multiple advertisement handlerCVE-2024-472495.0 Medium
- apache nimbleApache NimBLE: Buffer overflow in NimBLE MESH Bluetooth stackCVE-2024-472486.3 Medium
- apache answerApache Answer: Predictable Authorization Token Using UUIDv1CVE-2024-45719Fix available2.6 Low
- apache nifiApache NiFi: Potential Insertion of Sensitive Parameter Values in Debug LogCVE-2024-52067Fix available6.9 Medium
- apache traffic server, google android +1 moreIn bta_hd_set_report_act of bta_hd_act.cc, there is a possible out-of-bounds read due to an...CVE-2018-94816.5 Medium
- apache kafka, apache software foundation kafka clients +1 moreApache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProviderCVE-2024-31141Fix available6.5 Medium
- apache tomcatApache Tomcat: Incorrect JSP tag recycling leads to XSSCVE-2024-52318Public exploitFix available6.1 Medium
- apache tomcatApache Tomcat: Request/response mix-up with HTTP/2CVE-2024-52317Public exploitFix available6.5 Medium
- apache tomcat, debian linux +1 moreApache Tomcat: Authentication bypass when using Jakarta Authentication APICVE-2024-52316Public exploitFix available9.8 Critical
- apache hertzbeatApache HertzBeat: RCE by notice template injection vulnerabilityCVE-2024-411518.8 High
- apache hertzbeatApache HertzBeat: Exposure sensitive token via http GET method with query stringCVE-2024-457917.5 High
- apache hertzbeatApache HertzBeat: Exists Native Deser RCE and file writing vulnerabilitiesCVE-2024-455058.8 High
- apache ofbizApache OFBiz: URLs allowing remote use of Groovy expressions, leading to RCECVE-2024-472089.8 Critical
- apache ofbizApache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE)CVE-2024-489628.9 High
- apache airflowApache Airflow: Sensitive configuration values are not masked in the logs by defaultCVE-2024-45784Fix available7.5 High
- apache traffic serverApache Traffic Server: Server process can fail to drop privilegeCVE-2024-50306Fix available9.1 Critical
- apache traffic serverApache Traffic Server: Valid Host field value can cause crashesCVE-2024-50305Fix available7.5 High
- apache traffic serverApache Traffic Server: Cache key plugin is vulnerable to cache poisoning attackCVE-2024-38479Fix available7.5 High
- apache cloudstackApache CloudStack: Directly downloaded templates can be used to abuse KVM-based infrastructureCVE-2024-503868.5 High
- apache airflowApache Airflow: Secrets not masked in UI when sensitive variables are set via Airflow cliCVE-2024-50378Fix available4.9 Medium
- apache zookeeperApache ZooKeeper: Authentication bypass with IP-based authentication in Admin ServerCVE-2024-51504Fix available9.1 Critical
- apache kylinApache Kylin: Session fixation in web interfaceCVE-2024-23590Fix available9.1 Critical
- apache lucene, lucene.net, apache software foundation lucene.net.replicator +2 moreApache Lucene.Net.Replicator: Remote Code Execution in Lucene.Net.ReplicatorCVE-2024-43383Fix available8.0 High
- apache nifiApache NiFi: Improper Neutralization of Input in Parameter DescriptionCVE-2024-45477Fix available4.6 Medium
- apache syncopeApache Syncope: Stored XSS in Console and EnduserCVE-2024-450316.1 Medium
- apache cloudstackApache CloudStack: Uploaded and registered templates and volumes can be used to abuse KVM-based infrastructureCVE-2024-452198.5 High
- apache cloudstack, apache software foundation cloudstack quota plugin +1 moreApache CloudStack Quota plugin: Access checks not enforced in QuotaCVE-2024-454615.7 Medium
- apache cloudstackApache CloudStack: Incomplete session invalidation on web interface logoutCVE-2024-454626.3 Medium
- apache cloudstackApache CloudStack: Request origin validation bypass makes account takeover possibleCVE-2024-456938.0 High
- apache solrApache Solr: ConfigSets created during a backup restore command are trusted implicitlyCVE-2024-45217Fix available8.1 High
- apache solrApache Solr: Authentication bypass possible using a fake URL Path endingCVE-2024-45216Public exploitFix availableEPSS 92.7%9.8 Critical
- apache artemis, apache software foundation activemq artemis +1 moreApache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeansCVE-2023-50780Public exploitFix availableEPSS 17.3%8.8 High
- apache rollerApache Roller: Weakness in CSRF protection allows privilege escalationCVE-2024-469114.7 Medium
- apache subversionApache Subversion: Command line argument injection on Windows platformsCVE-2024-45720Fix available8.2 High
- apache xml graphics fop, formatting objects processor +1 moreApache XML Graphics FOP: XML External Entity (XXE) ProcessingCVE-2024-28168Fix available7.5 High
- apache commons io, netapp active iq unified manager, bluexp +5 more +7 moreApache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReaderCVE-2024-47554Fix available4.3 Medium
- apache avro, apache software foundation avro java sdk, netapp active iq unified manager +1 more +3 moreApache Avro Java SDK: Arbitrary Code Execution when reading Avro schema (Java SDK)CVE-2024-47561Fix available9.2 Critical
- apache lucene replicatorApache Lucene Replicator: Security Vulnerability in Lucene Replicator - Deserialization IssueCVE-2024-45772Fix available5.1 Medium
- apache maven archetype, apache software foundation maven archetype plugin +1 moreMaven Archetype Plugin: Maven Archetype integration-test may package local settings into the published artifact, possibly containing credentialsCVE-2024-47197Fix available7.5 High
- Show moreLoading…