Apache Software Foundation
Page 14 of 22 — Apache Software Foundation CVEs from a corpus of 2174, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-45802 | Critical | 9.8 | 2023-05-01 | Streampark allows any users to upload a jar as application, but there is no mandatory verification of the uploaded file type, causing users to upload some high… |
CVE-2022-45801 | Medium | 5.4 | 2023-05-01 | Apache StreamPark 1.0.0 to 2.0.0 have a LDAP injection vulnerability. LDAP Injection is an attack used to exploit web based applications that construct LDAP st… |
CVE-2023-22665 | Medium | 5.4 | 2023-04-25 | There is insufficient checking of user queries in Apache Jena versions 4.7.0 and earlier, when invoking custom scripts. It allows a remote user to execute arbi… |
CVE-2023-30776 | Medium | 4.9 | 2023-04-24 | An authenticated user with specific data permissions could access database connections stored passwords by requesting a specific REST API. This issue affects A… |
CVE-2023-27524 | High | 8.9 | 2023-04-24 | Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY accordi… |
CVE-2023-25601 | Medium | 4.3 | 2023-04-20 | On version 3.0.0 through 3.1.1, Apache DolphinScheduler's python gateway suffered from improper authentication: an attacker could use a socket bytes attack wit… |
CVE-2023-27525 | Low | 3.1 | 2023-04-17 | An authenticated user with Gamma role authorization could have access to metadata information using non trivial methods in Apache Superset up to and including… |
CVE-2023-25504 | Medium | 4.9 | 2023-04-17 | A malicious actor who has been authenticated and granted specific permissions in Apache Superset may use the import dataset feature in order to conduct Server-… |
CVE-2023-30771 | Critical | 9.8 | 2023-04-17 | Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component on 0.13.3. iotdb-web-work… |
CVE-2023-22946 | Medium | 6.4 | 2023-04-17 | In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute… |
CVE-2023-24831 | Critical | 9.8 | 2023-04-17 | Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects Apache IoTDB Grafana Connector: from 0.13.0 through 0.13.3… |
CVE-2022-47501 | High | 7.5 | 2023-04-14 | Arbitrary file reading vulnerability in Apache Software Foundation Apache OFBiz when using the Solr plugin. This is a pre-authentication attack. This issue af… |
CVE-2022-45064 | High | 8.0 | 2023-04-13 | The SlingRequestDispatcher doesn't correctly implement the RequestDispatcher API resulting in a generic type of include-based cross-site scripting issues on th… |
CVE-2023-30465 | Medium | 5.3 | 2023-04-11 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation Apache InLong.This issue affec… |
CVE-2023-29216 | Critical | 9.8 | 2023-04-10 | In Apache Linkis <=1.3.1, because the parameters are not effectively filtered, the attacker uses the MySQL data source and malicious parameters to configure a… |
CVE-2023-29215 | Critical | 9.8 | 2023-04-10 | In Apache Linkis <=1.3.1, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in JDBC EengineConn Mod… |
CVE-2023-27987 | Critical | 9.1 | 2023-04-10 | In Apache Linkis <=1.3.1, due to the default token generated by Linkis Gateway deployment being too simple, it is easy for attackers to obtain the default tok… |
CVE-2023-27603 | Critical | 9.8 | 2023-04-10 | In Apache Linkis <=1.3.1, due to the Manager module engineConn material upload does not check the zip path, This is a Zip Slip issue, which will lead to a p… |
CVE-2023-27602 | Critical | 9.8 | 2023-04-10 | In Apache Linkis <=1.3.1, The PublicService module uploads files without restrictions on the path to the uploaded files, and file types. We recommend users u… |
CVE-2023-28710 | High | 7.5 | 2023-04-07 | Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Spark Provider.This issue affects Apache Airflow Spark Provider: before 4… |
CVE-2023-28707 | High | 7.5 | 2023-04-07 | Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider.This issue affects Apache Airflow Drill Provider: before 2… |
CVE-2023-28706 | Critical | 9.8 | 2023-04-07 | Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Software Foundation Apache Airflow Hive Provider.This issue affects Apache Ai… |
CVE-2023-26269 | High | 7.8 | 2023-04-03 | Apache James server version 3.7.3 and earlier provides a JMX management service without authentication by default. This allows privilege escalation by a malic… |
CVE-2023-28935 | High | 8.8 | 2023-03-30 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation… |
CVE-2023-28158 | Medium | 6.5 | 2023-03-29 | Privilege escalation via stored XSS using the file upload service to upload malicious content. The issue can be exploited only by authenticated users which can… |
CVE-2023-28326 | Critical | 9.8 | 2023-03-28 | Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.0.0 Description: Attacker can elevate their privileges in a… |
CVE-2023-25197 | Medium | 6.3 | 2023-03-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation apache fineract. Authorized us… |
CVE-2023-25196 | Medium | 4.3 | 2023-03-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation Apache Fineract. Authorized us… |
CVE-2023-25195 | High | 8.1 | 2023-03-28 | Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache Fineract. Authorized users with limited permissions can gain access to se… |
CVE-2023-27296 | High | 8.8 | 2023-03-27 | Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong. It could be triggered by authenticated users of InLong, you could… |
CVE-2022-47502 | High | 7.8 | 2023-03-24 | Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose. Links can… |
CVE-2022-38745 | High | 7.8 | 2023-03-24 | Apache OpenOffice versions before 4.1.14 may be configured to add an empty entry to the Java class path. This may lead to run arbitrary Java code from the curr… |
CVE-2023-28708 | Medium | 4.3 | 2023-03-22 | When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookie… |
CVE-2023-26513 | High | 7.5 | 2023-03-20 | Excessive Iteration vulnerability in Apache Software Foundation Apache Sling Resource Merger.This issue affects Apache Sling Resource Merger: from 1.2.0 before… |
CVE-2023-25695 | Medium | 5.3 | 2023-03-15 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: befo… |
CVE-2023-26464 | High | 7.5 | 2023-03-10 | ** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a… |
CVE-2023-23638 | Medium | 5.0 | 2023-03-08 | A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x versio… |
CVE-2023-27522 | High | 7.5 | 2023-03-07 | HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special ch… |
CVE-2023-25690 | Critical | 9.8 | 2023-03-07 | Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when m… |
CVE-2023-25956 | High | 7.5 | 2023-02-24 | Generation of Error Message Containing Sensitive Information vulnerability in the Apache Airflow AWS Provider. This issue affects Apache Airflow AWS Provider… |
CVE-2023-25696 | Critical | 9.8 | 2023-02-24 | Improper Input Validation vulnerability in the Apache Airflow Hive Provider. This issue affects Apache Airflow Hive Provider versions before 5.1.3. |
CVE-2023-25693 | Critical | 9.8 | 2023-02-24 | Improper Input Validation vulnerability in the Apache Airflow Sqoop Provider. This issue affects Apache Airflow Sqoop Provider versions before 3.1.1. |
CVE-2023-25692 | High | 7.5 | 2023-02-24 | Improper Input Validation vulnerability in the Apache Airflow Google Provider. This issue affects Apache Airflow Google Provider versions before 8.10.0. |
CVE-2023-25691 | Critical | 9.8 | 2023-02-24 | Improper Input Validation vulnerability in the Apache Airflow Google Provider. This issue affects Apache Airflow Google Provider versions before 8.10.0. |
CVE-2023-25621 | Medium | 6.5 | 2023-02-23 | Privilege Escalation vulnerability in Apache Software Foundation Apache Sling. Any content author is able to create i18n dictionaries in the repository in a lo… |
CVE-2023-25613 | Critical | 9.8 | 2023-02-20 | An LDAP Injection vulnerability exists in the LdapIdentityBackend of Apache Kerby before 2.0.3. |
CVE-2023-24998 | High | 7.5 | 2023-02-20 | Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS wi… |
CVE-2022-42735 | High | 8.8 | 2023-02-15 | Improper Privilege Management vulnerability in Apache Software Foundation Apache ShenYu. ShenYu Admin allows low-privilege low-level administrators create us… |
CVE-2023-25141 | High | 7.5 | 2023-02-14 | Apache Sling JCR Base < 3.1.12 has a critical injection vulnerability when running on old JDK versions (JDK 1.8.191 or earlier) through utility functions in Re… |
CVE-2023-22832 | High | 7.5 | 2023-02-10 | The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references. Flow configurations that include the… |
CVE-2023-25194 | High | 8.8 | 2023-02-07 | A possible security vulnerability has been identified in Apache Kafka Connect API. This requires access to a Kafka Connect worker, and the ability to create/mo… |
CVE-2023-22849 | Medium | 6.1 | 2023-02-04 | An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.4 and prior may all… |
CVE-2022-45786 | High | 8.1 | 2023-02-04 | There are issues with the AGE drivers for Golang and Python that enable SQL injections to occur. This impacts AGE for PostgreSQL 11 & AGE for PostgreSQL 12, al… |
CVE-2023-24997 | Critical | 9.8 | 2023-02-01 | Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.5.0. Users a… |
CVE-2023-24977 | High | 7.5 | 2023-02-01 | Out-of-bounds Read vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.5.0. Users are advised to u… |
CVE-2022-28331 | Critical | 9.8 | 2023-01-31 | On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in apr_socket_sendv(). This is a result of integer overf… |
CVE-2022-25147 | Medium | 6.5 | 2023-01-31 | Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility (APR-util) allows an attacker to write beyond bounds of… |
CVE-2022-24963 | Critical | 9.8 | 2023-01-31 | Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. Th… |
CVE-2023-24829 | High | 8.8 | 2023-01-31 | Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component from 0.13.0 before 0.13.3… |
CVE-2022-44645 | High | 8.8 | 2023-01-31 | In Apache Linkis <=1.3.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attack… |
CVE-2022-44644 | Medium | 6.5 | 2023-01-31 | In Apache Linkis <=1.3.0 when used with the MySQL Connector/J in the data source module, an authenticated attacker could read arbitrary local files by connecti… |
CVE-2023-24830 | High | 7.5 | 2023-01-30 | Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects iotdb-web-workbench component: from 0.13.0 before 0.13.3. |
CVE-2023-22884 | Critical | 9.8 | 2023-01-21 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software… |
CVE-2022-37436 | Medium | 5.3 | 2023-01-17 | Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into… |
CVE-2022-36760 | Critical | 9.0 | 2023-01-17 | Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requ… |
CVE-2006-20001 | High | 7.5 | 2023-01-17 | A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent… |
CVE-2022-45438 | Medium | 5.3 | 2023-01-16 | When explicitly enabling the feature flag DASHBOARD_CACHE (disabled by default), the system allowed for an unauthenticated user to access dashboard configurati… |
CVE-2022-43721 | Medium | 5.4 | 2023-01-16 | An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could be redirected to this site when clickin… |
CVE-2022-43720 | Medium | 5.4 | 2023-01-16 | An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not get properly escaped by the toast messa… |
CVE-2022-43719 | High | 8.8 | 2023-01-16 | Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery. This issue affects Apache Superset version 1.5.2 an… |
CVE-2022-43718 | Medium | 5.4 | 2023-01-16 | Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by authenticated users with database connecti… |
CVE-2022-43717 | Medium | 5.4 | 2023-01-16 | Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vectors that can be performed by authentic… |
CVE-2022-41703 | Medium | 5.4 | 2023-01-16 | A vulnerability in the SQL Alchemy connector of Apache Superset allows an authenticated user with read access to a specific database to add subqueries to the W… |
CVE-2023-22602 | High | 7.5 | 2023-01-14 | When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication… |
CVE-2022-46769 | Medium | 5.4 | 2023-01-09 | An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.2 and prior may all… |
CVE-2022-45935 | Medium | 5.5 | 2023-01-06 | Usage of temporary files with insecure permissions by the Apache James server allows an attacker with local access to access private user data in transit. Vu… |
CVE-2022-45787 | Medium | 5.5 | 2023-01-06 | Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvider may lead to information disclosure to other local users. This issue a… |
CVE-2022-45875 | Critical | 9.8 | 2023-01-04 | Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability. This issue affects Apache Do… |
CVE-2022-45143 | High | 7.5 | 2023-01-03 | The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circ… |
CVE-2022-44621 | Critical | 9.8 | 2022-12-30 | Diagnosis Controller miss parameter validation, so user may attacked by command injection via HTTP Request. |
CVE-2022-43396 | High | 8.8 | 2022-12-30 | In the fix for CVE-2022-24697, a blacklist is used to filter user input commands. But there is a risk of being bypassed. The user can control the command by co… |
CVE-2022-45347 | Critical | 9.8 | 2022-12-22 | Apache ShardingSphere-Proxy prior to 5.3.0 when using MySQL as database backend didn't cleanup the database session completely after client authentication fail… |
CVE-2022-40145 | Critical | 9.8 | 2022-12-21 | This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL. The function jaas.modul… |
CVE-2022-46421 | Critical | 9.8 | 2022-12-20 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow Hive Provider.Th… |
CVE-2022-40743 | Medium | 6.1 | 2022-12-19 | Improper Input Validation vulnerability for the xdebug plugin in Apache Software Foundation Apache Traffic Server can lead to cross site scripting and cache po… |
CVE-2022-47500 | Medium | 6.1 | 2022-12-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Software Foundation Apache Helix UI component.This issue affects Apache Helix all r… |
CVE-2022-37392 | Medium | 5.3 | 2022-12-19 | Improper Check for Unusual or Exceptional Conditions vulnerability in handling the requests to Apache Traffic Server. This issue affects Apache Traffic Server… |
CVE-2022-32749 | High | 7.5 | 2022-12-19 | Improper Check for Unusual or Exceptional Conditions vulnerability handling requests in Apache Traffic Server allows an attacker to crash the server under cer… |
CVE-2022-46870 | Medium | 5.4 | 2022-12-16 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Zeppelin allows logged-in users to execute arbi… |
CVE-2021-28655 | Medium | 6.5 | 2022-12-16 | The improper Input Validation vulnerability in "”Move folder to Trash” feature of Apache Zeppelin allows an attacker to delete the arbitrary files. This issue… |
CVE-2022-32531 | Medium | 5.9 | 2022-12-15 | The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname verification fails… |
CVE-2022-34271 | High | 8.8 | 2022-12-14 | A vulnerability in import module of Apache Atlas allows an authenticated user to write to web server filesystem. This issue affects Apache Atlas versions from… |
CVE-2022-46364 | Critical | 9.8 | 2022-12-13 | A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perf… |
CVE-2022-46363 | High | 7.5 | 2022-12-13 | A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability… |
CVE-2022-45910 | Medium | 5.3 | 2022-12-07 | Improper neutralization of special elements used in an LDAP query ('LDAP Injection') vulnerability in ActiveDirectory and Sharepoint ActiveDirectory authority… |
CVE-2021-37533 | Medium | 6.5 | 2022-12-03 | Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use… |
CVE-2022-46366 | Critical | 9.8 | 2022-12-02 | Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. This issue is similar to but distinct from CVE-2020-17531, whic… |
CVE-2022-44635 | High | 8.8 | 2022-11-29 | Apache Fineract allowed an authenticated user to perform remote code execution due to a path traversal vulnerability in a file upload component of Apache Finer… |
CVE-2022-26885 | High | 7.5 | 2022-11-24 | When using tasks to read config files, there is a risk of database password disclosure. We recommend you upgrade to version 2.0.6 or higher. |
CVE-2022-45462 | Critical | 9.8 | 2022-11-23 | Alarm instance management has command injection when there is a specific command configured. It is only for logged-in users. We recommend you upgrade to versio… |