Apache Software Foundation vulnerabilities

Products

• Cloudstack 4
• Traffic Server 4
• Dolphinscheduler 2
• Http Server 2
• Inlong 2
• Ofbiz 2

Newest

• apache arrow, apache software foundation arrow r package +1 more Apache Arrow R package: Arbitrary code execution when loading a malicious data file CVE-2024-52338 Fix available 9.8 CriticalNovember 28, 2024
• apache traffic server Apache Traffic Server: Server process can fail to drop privilege CVE-2024-50306 Fix available 9.1 CriticalNovember 14, 2024
• apache traffic server Apache Traffic Server: Valid Host field value can cause crashes CVE-2024-50305 Fix available 7.5 HighNovember 14, 2024
• apache traffic server Apache Traffic Server: Cache key plugin is vulnerable to cache poisoning attack CVE-2024-38479 Fix available 7.5 HighNovember 14, 2024
• apache kylin Apache Kylin: Session fixation in web interface CVE-2024-23590 Fix available 9.1 CriticalNovember 4, 2024
• apache cloudstack Apache CloudStack: Uploaded and registered templates and volumes can be used to abuse KVM-based infrastructure CVE-2024-45219 8.5 HighOctober 16, 2024
• apache cloudstack Apache CloudStack: Incomplete session invalidation on web interface logout CVE-2024-45462 6.3 MediumOctober 16, 2024
• apache solr Apache Solr: ConfigSets created during a backup restore command are trusted implicitly CVE-2024-45217 Fix available 8.1 HighOctober 16, 2024
• apache linkis, apache software foundation linkis spark engineconn +1 more Apache Linkis Spark EngineConn: Commons Lang's RandomStringUtils Random string security vulnerability CVE-2024-39928 Fix available 7.5 HighSeptember 24, 2024
• apache ofbiz Apache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCE CVE-2024-45507 Public exploit EPSS 96.4% 9.8 CriticalSeptember 4, 2024
• apache seatunnel, apache software foundation seatunnel web +1 more Apache SeaTunnel Web: Arbitrary file read vulnerability CVE-2023-49198 Fix available 7.5 HighAugust 21, 2024
• apache helix, apache software foundation helix front (ui), helix front\/ui\/ +2 more Apache Helix Front (UI): Helix front hard-coded secret in the express-session CVE-2024-22281 7.5 HighAugust 20, 2024
• apache dolphinscheduler Apache DolphinScheduler: Remote Code Execution Vulnerability CVE-2024-43202 Public exploitFix available 9.8 CriticalAugust 20, 2024
• apache dolphinscheduler Apache DolphinScheduler: RCE by arbitrary js execution CVE-2024-29831 Fix available 8.8 HighAugust 9, 2024
• apache inlong, apache software foundation inlong tubemq client +1 more Apache InLong TubeMQ Client: Remote Code Execution vulnerability CVE-2024-36268 Fix available 9.8 CriticalAugust 2, 2024
• apache drill Apache Drill: XXE Vulnerability in XML Format Reader CVE-2023-48362 Fix available 8.8 HighJuly 24, 2024
• apache streampark Apache StreamPark: session not invalidated after logout CVE-2024-29070 9.1 CriticalJuly 23, 2024
• apache cloudstack Apache CloudStack: SAML Signature Exclusion CVE-2024-41107 Public exploit EPSS 17.8% 8.1 HighJuly 19, 2024
• apache streampipes Apache StreamPipes: Potential remote code execution (RCE) via file upload CVE-2024-31411 Fix available 8.8 HighJuly 17, 2024
• apache cloudstack Apache CloudStack: Integration API service uses dynamic port when disabled CVE-2024-39864 9.8 CriticalJuly 5, 2024
• apache http server, netapp ontap +1 more Apache HTTP Server proxy encoding problem CVE-2024-38473 Public exploitFix available EPSS 25.9% 8.1 HighJuly 1, 2024
• apache http server, netapp ontap +1 more Apache HTTP Server on WIndows UNC SSRF CVE-2024-38472 Public exploitFix available EPSS 69.5% 7.5 HighJuly 1, 2024
• apache ofbiz Apache OFBiz: Path traversal leading to a RCE CVE-2024-36104 Public exploit EPSS 87.9% 9.1 CriticalJune 4, 2024
• apache inlong Apache Inlong JDBC Vulnerability CVE-2024-26579 Fix available 9.8 CriticalMay 8, 2024
• apache apisix Apache APISIX: Forward-Auth Request Smuggling CVE-2024-32638 Fix available 6.3 MediumMay 2, 2024
• apache zeppelin Apache Zeppelin: Interpreter download command does not escape malicious code injection CVE-2024-31866 Fix available 9.8 CriticalApril 9, 2024
• apache archiva Apache Archiva: incorrect authentication potentially leading to account takeover CVE-2024-27139 7.5 HighMarch 1, 2024
• apache aurora Apache Aurora: padding oracle can allow construction an authentication cookie CVE-2024-27905 9.1 CriticalFebruary 27, 2024
• apache answer Apache Answer: Pixel Flood Attack by uploading the large pixel file CVE-2024-22393 Public exploitFix available 9.1 CriticalFebruary 22, 2024
• apache superset Apache Superset: Unnecessary read permissions within the Gamma role CVE-2023-42501 Fix available 4.3 MediumNovember 27, 2023
• apache traffic server, fedoraproject fedora +1 more Apache Traffic Server: s3_auth plugin problem with hash calculation CVE-2023-41752 Fix available 7.5 HighOctober 17, 2023