Apache Software Foundation
Page 12 of 22 — Apache Software Foundation CVEs from a corpus of 2174, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-50291 | High | 7.5 | 2024-02-09 | Insufficiently Protected Credentials vulnerability in Apache Solr. This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of… |
CVE-2024-23452 | High | 7.5 | 2024-02-08 | Request smuggling vulnerability in HTTP server in Apache bRPC 0.9.5~1.7.0 on all platforms allows attacker to smuggle request. Vulnerability Cause Description… |
CVE-2023-39196 | Medium | 5.3 | 2024-02-07 | Improper Authentication vulnerability in Apache Ozone. The vulnerability allows an attacker to download metadata internal to the Storage Container Manager ser… |
CVE-2023-51437 | High | 7.4 | 2024-02-07 | Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider can allow an attacker to forge a SASL Role Token that will pass signa… |
CVE-2024-23673 | High | 8.5 | 2024-02-06 | Malicious code execution via path traversal in Apache Software Foundation Apache Sling Servlets Resolver.This issue affects all version of Apache Sling Servlet… |
CVE-2023-44313 | High | 7.6 | 2024-01-31 | Server-Side Request Forgery (SSRF) vulnerability in Apache ServiceComb Service-Center. Attackers can obtain sensitive server information through specially craf… |
CVE-2023-44312 | Medium | 5.8 | 2024-01-31 | Exposure of Sensitive Information to an Unauthorized Actor in Apache ServiceComb Service-Center.This issue affects Apache ServiceComb Service-Center before… |
CVE-2023-29055 | High | 7.5 | 2024-01-29 | In Apache Kylin version 2.0.0 to 4.0.3, there is a Server Config web interface that displays the content of file 'kylin.properties', that may contain serversid… |
CVE-2023-51702 | Medium | 6.5 | 2024-01-24 | Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configu… |
CVE-2023-50944 | Medium | 6.5 | 2024-01-24 | Apache Airflow, versions before 2.8.1, have a vulnerability that allows an authenticated user to access the source code of a DAG to which they don't have acces… |
CVE-2023-50943 | High | 7.5 | 2024-01-24 | Apache Airflow, versions before 2.8.1, have a vulnerability that allows a potential attacker to poison the XCom data by bypassing the protection of "enable_xco… |
CVE-2023-49657 | Critical | 9.6 | 2024-01-23 | A stored cross-site scripting (XSS) vulnerability exists in Apache Superset before 3.0.3. An authenticated attacker with create/update permissions on charts or… |
CVE-2024-21733 | Medium | 5.3 | 2024-01-19 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9… |
CVE-2023-46226 | Critical | 9.8 | 2024-01-15 | Remote Code Execution vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 1.0.0 through 1.2.2. Users are recommended to upgrade to version 1.3… |
CVE-2023-50290 | Medium | 6.5 | 2024-01-15 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr. The Solr Metrics API publishes all unprotected environment variables a… |
CVE-2023-46749 | Medium | 6.5 | 2024-01-15 | Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with pat… |
CVE-2023-49619 | Low | 3.1 | 2024-01-10 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Answer. This issue affects Apache Answer… |
CVE-2023-51441 | High | 7.2 | 2024-01-06 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Input Validation vulnerability in Apache Axis allowed users with access to the admin service to perform possible SSRF … |
CVE-2023-51785 | High | 7.5 | 2024-01-03 | Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.7.0 through 1.9.0, the attackers can make a arbitrary… |
CVE-2023-51784 | Critical | 9.8 | 2024-01-03 | Improper Control of Generation of Code ('Code Injection') vulnerability in Apache InLong.This issue affects Apache InLong: from 1.5.0 through 1.9.0, which coul… |
CVE-2023-49299 | High | 8.8 | 2023-12-30 | Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the ser… |
CVE-2023-47804 | High | 8.8 | 2023-12-29 | Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose. Links can… |
CVE-2023-51467 | Critical | 9.8 | 2023-12-26 | The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code |
CVE-2023-50968 | High | 7.5 | 2023-12-26 | Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations. The same uri… |
CVE-2023-51656 | Critical | 9.8 | 2023-12-21 | Deserialization of Untrusted Data vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 0.13.0 through 0.13.4. Users are recommended to upgrade… |
CVE-2023-50783 | Medium | 6.5 | 2023-12-21 | Apache Airflow, versions before 2.8.0, is affected by a vulnerability that allows an authenticated user without the variable edit permission, to update a varia… |
CVE-2023-49920 | Medium | 6.5 | 2023-12-21 | Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation. As a result… |
CVE-2023-48291 | Medium | 4.3 | 2023-12-21 | Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a re… |
CVE-2023-47265 | Medium | 5.4 | 2023-12-21 | Apache Airflow, versions 2.6.0 through 2.7.3 has a stored XSS vulnerability that allows a DAG author to add an unbounded and not-sanitized javascript in the pa… |
CVE-2023-37544 | High | 7.5 | 2023-12-20 | Improper Authentication vulnerability in Apache Pulsar WebSocket Proxy allows an attacker to connect to the /pingpong endpoint without authentication. This is… |
CVE-2023-43826 | High | 7.5 | 2023-12-19 | Apache Guacamole 1.5.3 and older do not consistently ensure that values received from a VNC server will not result in integer overflow. If a user connects to a… |
CVE-2023-49736 | Medium | 6.5 | 2023-12-19 | A where_in JINJA macro allows users to specify a quote, which combined with a carefully crafted statement would allow for SQL injection in Apache Superset.This… |
CVE-2023-49734 | High | 7.7 | 2023-12-19 | An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts al… |
CVE-2023-46104 | Medium | 6.5 | 2023-12-19 | Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vu… |
CVE-2023-41314 | High | 8.2 | 2023-12-18 | The api /api/snapshot and /api/get_log_file would allow unauthenticated access. It could allow a DoS attack or get arbitrary files from FE node. Please upgrade… |
CVE-2023-49898 | High | 7.2 | 2023-12-15 | In streampark, there is a project module that integrates Maven's compilation capability. However, there is no check on the compilation parameters of Maven. all… |
CVE-2023-30867 | Medium | 4.9 | 2023-12-15 | In the Streampark platform, when users log in to the system and use certain features, some pages provide a name-based fuzzy search, such as job names, role nam… |
CVE-2023-46279 | Critical | 9.8 | 2023-12-15 | Deserialization of Untrusted Data vulnerability in Apache Dubbo.This issue only affects Apache Dubbo 3.1.5. Users are recommended to upgrade to the latest ver… |
CVE-2023-29234 | Critical | 9.8 | 2023-12-15 | A deserialization vulnerability existed when decode a malicious package.This issue affects Apache Dubbo: from 3.1.0 through 3.1.10, from 3.2.0 through 3.2.4. … |
CVE-2023-46750 | Medium | 6.1 | 2023-12-14 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro. Mitigation: Update to Apache Shiro 1.13.0… |
CVE-2023-45725 | Medium | 5.7 | 2023-12-13 | Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document. T… |
CVE-2023-50164 | Critical | 9.8 | 2023-12-07 | An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be u… |
CVE-2023-41835 | High | 7.5 | 2023-12-05 | When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even… |
CVE-2023-49070 | Critical | 9.8 | 2023-12-05 | Pre-auth RCE in Apache Ofbiz 18.12.09. It's due to XML-RPC no longer maintained still present. This issue affects Apache OFBiz: before 18.12.10. Users are re… |
CVE-2023-49735 | High | 7.5 | 2023-11-30 | ** UNSUPPORTED WHEN ASSIGNED ** The value set as the DefaultLocaleResolver.LOCALE_KEY attribute on the session was not validated while resolving XML definitio… |
CVE-2023-49733 | Critical | 9.8 | 2023-11-30 | Improper Restriction of XML External Entity Reference vulnerability in Apache Cocoon.This issue affects Apache Cocoon: from 2.2.0 before 2.3.0. Users are reco… |
CVE-2023-49620 | Medium | 6.5 | 2023-11-30 | Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unaut… |
CVE-2022-45135 | Critical | 9.8 | 2023-11-30 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Cocoon.This issue affects Apache Cocoon: from 2.2… |
CVE-2023-42504 | Medium | 5.8 | 2023-11-28 | An authenticated malicious user could initiate multiple concurrent requests, each requesting multiple dashboard exports, leading to a possible denial of servic… |
CVE-2023-42505 | Medium | 4.3 | 2023-11-28 | An authenticated user with read permissions on database connections metadata could potentially access sensitive information such as the connection's username. … |
CVE-2023-42502 | Medium | 4.8 | 2023-11-28 | An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be red… |
CVE-2023-46589 | High | 7.5 | 2023-11-28 | Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82… |
CVE-2022-41678 | High | 8.8 | 2023-11-28 | Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allows org.jolok… |
CVE-2023-49145 | High | 7.9 | 2023-11-27 | Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration user interface that is vulnerable to DOM-bas… |
CVE-2023-43701 | Medium | 4.3 | 2023-11-27 | Improper payload validation and an improper REST API response type, made it possible for an authenticated malicious actor to store malicious code into Chart's… |
CVE-2023-42501 | Medium | 4.3 | 2023-11-27 | Unnecessary read permissions within the Gamma role would allow authenticated users to read configured CSS templates and annotations. This issue affects Apache… |
CVE-2023-40610 | Medium | 6.3 | 2023-11-27 | Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection tha… |
CVE-2023-49068 | High | 7.5 | 2023-11-27 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.This issue affects Apache DolphinScheduler: before 3.2.1. … |
CVE-2023-48796 | High | 7.5 | 2023-11-24 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. The information exposed to unauthorized actors may includ… |
CVE-2023-43123 | Medium | 5.5 | 2023-11-23 | On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/dir… |
CVE-2023-37924 | Critical | 9.8 | 2023-11-22 | Apache Software Foundation Apache Submarine has an SQL injection vulnerability when a user logs in. This issue can result in unauthorized login. Now we have fi… |
CVE-2023-46302 | Critical | 9.8 | 2023-11-20 | Apache Software Foundation Apache Submarine has a bug when serializing against yaml. The bug is caused by snakeyaml https://nvd.nist.gov/vuln/detail/CVE-2022-… |
CVE-2022-46337 | Critical | 9.8 | 2023-11-20 | A cleverly devised username might bypass LDAP authentication checks. In LDAP-authenticated Derby installations, this could let an attacker fill up the disk b… |
CVE-2023-26031 | High | 7.5 | 2023-11-16 | Relative library resolution in linux container-executor binary in Apache Hadoop 3.3.1-3.3.4 on Linux allows local user to gain root privileges. If the YARN clu… |
CVE-2023-47037 | Medium | 4.3 | 2023-11-12 | We failed to apply CVE-2023-40611 in 2.7.1 and this vulnerability was marked as fixed then. Apache Airflow, versions before 2.7.3, is affected by a vulnerabi… |
CVE-2023-42781 | Medium | 6.5 | 2023-11-12 | Apache Airflow, versions before 2.7.3, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about… |
CVE-2023-47248 | Critical | 9.8 | 2023-11-09 | Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable… |
CVE-2023-39913 | High | 8.8 | 2023-11-08 | Deserialization of Untrusted Data, Improper Input Validation vulnerability in Apache UIMA Java SDK, Apache UIMA Java SDK, Apache UIMA Java SDK, Apache UIMA Jav… |
CVE-2023-46819 | Medium | 5.3 | 2023-11-07 | Missing Authentication in Apache Software Foundation Apache OFBiz when using the Solr plugin. This issue affects Apache OFBiz: before 18.12.09. Users are rec… |
CVE-2023-46851 | Medium | 4.9 | 2023-11-07 | Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments. Project administrators can run these imports, which could c… |
CVE-2023-46215 | High | 7.5 | 2023-10-28 | Insertion of Sensitive Information into Log File vulnerability in Apache Airflow Celery provider, Apache Airflow. Sensitive information logged as clear text w… |
CVE-2023-46604 | Critical | 10.0 | 2023-10-27 | The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a… |
CVE-2023-46288 | Medium | 4.3 | 2023-10-23 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.4.0 to 2.7.0. Sensitive co… |
CVE-2023-45802 | Medium | 5.9 | 2023-10-23 | When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de… |
CVE-2023-43622 | High | 7.5 | 2023-10-23 | An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. Th… |
CVE-2023-31122 | High | 7.5 | 2023-10-23 | Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57. |
CVE-2023-44483 | Medium | 6.5 | 2023-10-20 | All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a priva… |
CVE-2023-46227 | High | 7.5 | 2023-10-19 | Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong. This issue affects Apache InLong: from 1.4.0 through 1.8.0, the… |
CVE-2023-25753 | Medium | 6.5 | 2023-10-19 | There exists an SSRF (Server-Side Request Forgery) vulnerability located at the /sandbox/proxyGateway endpoint. This vulnerability allows us to manipulate arb… |
CVE-2023-41752 | High | 7.5 | 2023-10-17 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through… |
CVE-2023-39456 | High | 7.5 | 2023-10-17 | Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames.This issue affects Apache Traffic Server: from 9.0.0 through 9.2… |
CVE-2023-45757 | Medium | 6.1 | 2023-10-16 | Security vulnerability in Apache bRPC <=1.6.0 on all platforms allows attackers to inject XSS code to the builtin rpcz page. An attacker that can send http req… |
CVE-2023-43668 | Critical | 9.8 | 2023-10-16 | Authorization Bypass Through User-Controlled Key vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, some sensitive pa… |
CVE-2023-43667 | High | 7.5 | 2023-10-16 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache InLong.This issue affects Apache InL… |
CVE-2023-43666 | Medium | 6.5 | 2023-10-16 | Insufficient Verification of Data Authenticity vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, General user can vi… |
CVE-2023-45348 | Medium | 4.3 | 2023-10-14 | Apache Airflow, versions 2.7.0 and 2.7.1, is affected by a vulnerability that allows an authenticated user to retrieve sensitive configuration information when… |
CVE-2023-42792 | Medium | 6.5 | 2023-10-14 | Apache Airflow, in versions prior to 2.7.2, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a re… |
CVE-2023-42780 | Medium | 6.5 | 2023-10-14 | Apache Airflow, versions prior to 2.7.2, contains a security vulnerability that allows authenticated users of Airflow to list warnings for all DAGs, even if th… |
CVE-2023-42663 | Medium | 6.5 | 2023-10-14 | Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about… |
CVE-2023-44981 | Critical | 9.1 | 2023-10-11 | Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper (quorum.auth.ena… |
CVE-2023-45648 | Medium | 5.3 | 2023-10-10 | Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81… |
CVE-2023-42795 | Medium | 5.3 | 2023-10-10 | Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 th… |
CVE-2023-42794 | Medium | 5.9 | 2023-10-10 | Incomplete Cleanup vulnerability in Apache Tomcat. The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 throug… |
CVE-2023-39410 | High | 7.5 | 2023-09-29 | When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on… |
CVE-2023-41834 | Medium | 6.1 | 2023-09-19 | Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Flink Stateful Functions 3.1.0, 3.1.1 and 3.2.0 allows remote attackers to inject arbitrary… |
CVE-2023-42503 | Medium | 5.5 | 2023-09-14 | Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.This issue affects Apache Commons Compress… |
CVE-2023-41267 | High | 7.8 | 2023-09-14 | In the Apache Airflow HDFS Provider, versions prior to 4.1.1, a documentation info pointed users to an install incorrect pip package. As this package name was… |
CVE-2023-41081 | High | 7.5 | 2023-09-13 | Important: Authentication Bypass CVE-2023-41081 The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included … |
CVE-2023-40712 | Medium | 6.5 | 2023-09-12 | Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a… |
CVE-2023-40611 | Medium | 4.3 | 2023-09-12 | Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail val… |