Apache
Page 13 of 15 — Apache CVEs from a corpus of 1457, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-36543 | Medium | 6.5 | 2023-07-12 | Apache Airflow, versions before 2.6.3, has a vulnerability where an authenticated user can use crafted input to make the current request hang. It is recommende… |
CVE-2023-35908 | Medium | 6.5 | 2023-07-12 | Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows unauthorized read access to a DAG through the URL. It is recommended to upgra… |
CVE-2023-31007 | Unrated | | 2023-07-12 | Improper Authentication vulnerability in Apache Software Foundation Apache Pulsar Broker allows a client to stay connected to a broker after authentication dat… |
CVE-2023-30429 | Critical | 9.6 | 2023-07-12 | Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar. This issue affects Apache Pulsar: before 2.10.4, and 2.11.0. When a client… |
CVE-2023-30428 | High | 8.2 | 2023-07-12 | Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Broker's Rest Producer allows authenticated user with a custom HTTP header to… |
CVE-2023-22888 | Medium | 6.5 | 2023-07-12 | Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to cause a service disruption by manipulating the run_id paramete… |
CVE-2023-22887 | Medium | 6.5 | 2023-07-12 | Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to perform unauthorized file access outside the intended director… |
CVE-2022-46651 | Medium | 6.5 | 2023-07-12 | Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an unauthorized actor to gain access to sensitive information in Connection e… |
CVE-2022-45855 | High | 8.0 | 2023-07-12 | SpringEL injection in the metrics source in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. User… |
CVE-2022-42009 | High | 8.0 | 2023-07-12 | SpringEL injection in the server agent in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. Users… |
CVE-2023-32200 | High | 8.8 | 2023-07-12 | There is insufficient restrictions of called script functions in Apache Jena versions 4.8.0 and earlier. It allows a remote user to execute javascript via a… |
CVE-2023-35887 | Medium | 5.0 | 2023-07-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA. In SFTP servers implemented using Apache M… |
CVE-2023-34442 | Low | 3.3 | 2023-07-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Camel.This issue affects Apache Camel: from 3.X t… |
CVE-2023-33008 | Medium | 5.3 | 2023-07-07 | Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache Johnzon. A malicious attacker can craft up some JSON input that uses lar… |
CVE-2023-34150 | Medium | 6.5 | 2023-07-05 | ** UNSUPPORTED WHEN ASSIGNED ** Use of TikaEncodingDetector in Apache Any23 can cause excessive memory usage. |
CVE-2023-35797 | Critical | 9.8 | 2023-07-03 | Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Hive Provider. This issue affects Apache Airflow Apache Hive Provider: bef… |
CVE-2023-22886 | High | 8.8 | 2023-06-29 | Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow JDBC Provider. Airflow JDBC Provider Connection’s [Connection URL] paramet… |
CVE-2023-35798 | Medium | 4.3 | 2023-06-27 | Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.This vulner… |
CVE-2023-34395 | High | 7.8 | 2023-06-27 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Software Foundation Apache Airflow ODBC Provider. In… |
CVE-2023-31469 | High | 8.8 | 2023-06-23 | A REST interface in Apache StreamPipes (versions 0.69.0 to 0.91.0) was not properly restricted to admin-only access. This allowed a non-admin user with valid… |
CVE-2023-34981 | High | 7.5 | 2023-06-21 | A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP S… |
CVE-2023-34340 | Critical | 9.8 | 2023-06-21 | Improper Authentication vulnerability in Apache Software Foundation Apache Accumulo. This issue affects Apache Accumulo: 2.1.0. Accumulo 2.1.0 contains a defe… |
CVE-2023-35005 | Medium | 6.5 | 2023-06-19 | In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations. This vulnerability is mitigated by the fact configura… |
CVE-2023-34396 | Medium | 4.3 | 2023-06-14 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30… |
CVE-2023-34149 | Medium | 4.3 | 2023-06-14 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30… |
CVE-2023-33933 | High | 7.5 | 2023-06-14 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic… |
CVE-2023-30631 | High | 7.5 | 2023-06-14 | Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server. The configuration option proxy.config.http.push_method_enabled di… |
CVE-2022-47184 | High | 7.5 | 2023-06-14 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic… |
CVE-2023-34468 | High | 8.8 | 2023-06-12 | The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configu… |
CVE-2023-34212 | Medium | 6.5 | 2023-06-12 | The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an auth… |
CVE-2023-30576 | Medium | 6.8 | 2023-06-07 | Apache Guacamole 0.9.10 through 1.5.1 may continue to reference a freed RDP audio input buffer. Depending on timing, this may allow an attacker to execute arbi… |
CVE-2023-30575 | Medium | 6.5 | 2023-06-07 | Apache Guacamole 1.5.1 and older may incorrectly calculate the lengths of instruction elements sent during the Guacamole protocol handshake, potentially allowi… |
CVE-2023-33234 | High | 7.2 | 2023-05-30 | Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection… |
CVE-2023-30601 | High | 7.8 | 2023-05-30 | Privilege escalation when enabling FQL/Audit logs allows user with JMX access to run arbitrary commands as the user running Apache Cassandra This issue affects… |
CVE-2022-46907 | Medium | 6.1 | 2023-05-25 | A carefully crafted request on several JSPWiki plugins could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascri… |
CVE-2023-33246 | Critical | 9.8 | 2023-05-24 | For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of RocketMQ, including NameS… |
CVE-2023-31103 | High | 7.5 | 2023-05-22 | Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Att… |
CVE-2023-31101 | Medium | 6.5 | 2023-05-22 | Insecure Default Initialization of Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.5.0 through 1.6… |
CVE-2023-31098 | Critical | 9.8 | 2023-05-22 | Weak Password Requirements vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.6.0. When users c… |
CVE-2023-31066 | Critical | 9.1 | 2023-05-22 | Files or Directories Accessible to External Parties vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 thro… |
CVE-2023-31065 | Critical | 9.1 | 2023-05-22 | Insufficient Session Expiration vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. An old… |
CVE-2023-31064 | High | 7.5 | 2023-05-22 | Files or Directories Accessible to External Parties vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 thro… |
CVE-2023-31062 | Critical | 9.8 | 2023-05-22 | Improper Privilege Management Vulnerabilities in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. When the… |
CVE-2023-31454 | High | 7.5 | 2023-05-22 | Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 th… |
CVE-2023-31453 | High | 7.5 | 2023-05-22 | Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 th… |
CVE-2023-31206 | High | 7.5 | 2023-05-22 | Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Atta… |
CVE-2023-31058 | High | 7.5 | 2023-05-22 | Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Attacke… |
CVE-2023-28709 | High | 7.5 | 2023-05-22 | The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTT… |
CVE-2022-47937 | Critical | 9.8 | 2023-05-15 | Improper input validation in the Apache Sling Commons JSON bundle allows an attacker to trigger unexpected errors by supplying specially-crafted input. The or… |
CVE-2023-29246 | High | 7.2 | 2023-05-12 | An attacker who has gained access to an admin account can perform RCE via null-byte injection Vendor: The Apache Software Foundation Versions Affected: Apach… |
CVE-2023-29032 | High | 8.1 | 2023-05-12 | An attacker that has gained access to certain private information can use this to act as other user. Vendor: The Apache Software Foundation Versions Affected… |
CVE-2023-28936 | Medium | 5.3 | 2023-05-12 | Attacker can access arbitrary recording/room Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0 |
CVE-2023-25754 | Critical | 9.8 | 2023-05-08 | Privilege Context Switching Error vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: before 2.6.0. |
CVE-2023-29247 | Medium | 5.4 | 2023-05-08 | Task instance details page in the UI is vulnerable to a stored XSS.This issue affects Apache Airflow: before 2.6.0. |
CVE-2023-31039 | Critical | 9.8 | 2023-05-08 | Security vulnerability in Apache bRPC <1.5.0 on all platforms allows attackers to execute arbitrary code via ServerOptions::pid_file. An attacker that can infl… |
CVE-2023-31038 | High | 8.8 | 2023-05-08 | SQL injection in Log4cxx when using the ODBC appender to send log messages to a database. No fields sent to the database were properly escaped for SQL injecti… |
CVE-2022-45048 | High | 8.4 | 2023-05-05 | Authenticated users with appropriate privileges can create policies having expressions that can exploit code execution vulnerability. This issue affects Apache… |
CVE-2021-40331 | High | 8.1 | 2023-05-05 | An Incorrect Permission Assignment for Critical Resource vulnerability was found in the Apache Ranger Hive Plugin. Any user with SELECT privilege on a database… |
CVE-2023-26268 | Medium | 4.4 | 2023-05-02 | Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document fu… |
CVE-2023-32007 | High | 8.8 | 2023-05-02 | ** UNSUPPORTED WHEN ASSIGNED ** The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authenticatio… |
CVE-2022-46365 | Critical | 9.1 | 2023-05-01 | Apache StreamPark 1.0.0 before 2.0.0 When the user successfully logs in, to modify his profile, the username will be passed to the server-layer as a parameter… |
CVE-2022-45802 | Critical | 9.8 | 2023-05-01 | Streampark allows any users to upload a jar as application, but there is no mandatory verification of the uploaded file type, causing users to upload some high… |
CVE-2022-45801 | Medium | 5.4 | 2023-05-01 | Apache StreamPark 1.0.0 to 2.0.0 have a LDAP injection vulnerability. LDAP Injection is an attack used to exploit web based applications that construct LDAP st… |
CVE-2023-22665 | Medium | 5.4 | 2023-04-25 | There is insufficient checking of user queries in Apache Jena versions 4.7.0 and earlier, when invoking custom scripts. It allows a remote user to execute arbi… |
CVE-2023-30776 | Medium | 4.9 | 2023-04-24 | An authenticated user with specific data permissions could access database connections stored passwords by requesting a specific REST API. This issue affects A… |
CVE-2023-27524 | High | 8.9 | 2023-04-24 | Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY accordi… |
CVE-2023-25601 | Medium | 4.3 | 2023-04-20 | On version 3.0.0 through 3.1.1, Apache DolphinScheduler's python gateway suffered from improper authentication: an attacker could use a socket bytes attack wit… |
CVE-2023-27525 | Low | 3.1 | 2023-04-17 | An authenticated user with Gamma role authorization could have access to metadata information using non trivial methods in Apache Superset up to and including… |
CVE-2023-25504 | Medium | 4.9 | 2023-04-17 | A malicious actor who has been authenticated and granted specific permissions in Apache Superset may use the import dataset feature in order to conduct Server-… |
CVE-2023-30771 | Critical | 9.8 | 2023-04-17 | Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component on 0.13.3. iotdb-web-work… |
CVE-2023-22946 | Medium | 6.4 | 2023-04-17 | In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute… |
CVE-2023-24831 | Critical | 9.8 | 2023-04-17 | Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects Apache IoTDB Grafana Connector: from 0.13.0 through 0.13.3… |
CVE-2022-47501 | High | 7.5 | 2023-04-14 | Arbitrary file reading vulnerability in Apache Software Foundation Apache OFBiz when using the Solr plugin. This is a pre-authentication attack. This issue af… |
CVE-2022-45064 | High | 8.0 | 2023-04-13 | The SlingRequestDispatcher doesn't correctly implement the RequestDispatcher API resulting in a generic type of include-based cross-site scripting issues on th… |
CVE-2023-30465 | Medium | 5.3 | 2023-04-11 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation Apache InLong.This issue affec… |
CVE-2023-29216 | Critical | 9.8 | 2023-04-10 | In Apache Linkis <=1.3.1, because the parameters are not effectively filtered, the attacker uses the MySQL data source and malicious parameters to configure a… |
CVE-2023-29215 | Critical | 9.8 | 2023-04-10 | In Apache Linkis <=1.3.1, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in JDBC EengineConn Mod… |
CVE-2023-27987 | Critical | 9.1 | 2023-04-10 | In Apache Linkis <=1.3.1, due to the default token generated by Linkis Gateway deployment being too simple, it is easy for attackers to obtain the default tok… |
CVE-2023-27603 | Critical | 9.8 | 2023-04-10 | In Apache Linkis <=1.3.1, due to the Manager module engineConn material upload does not check the zip path, This is a Zip Slip issue, which will lead to a p… |
CVE-2023-27602 | Critical | 9.8 | 2023-04-10 | In Apache Linkis <=1.3.1, The PublicService module uploads files without restrictions on the path to the uploaded files, and file types. We recommend users u… |
CVE-2023-28710 | High | 7.5 | 2023-04-07 | Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Spark Provider.This issue affects Apache Airflow Spark Provider: before 4… |
CVE-2023-28707 | High | 7.5 | 2023-04-07 | Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider.This issue affects Apache Airflow Drill Provider: before 2… |
CVE-2023-28706 | Critical | 9.8 | 2023-04-07 | Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Software Foundation Apache Airflow Hive Provider.This issue affects Apache Ai… |
CVE-2023-26269 | High | 7.8 | 2023-04-03 | Apache James server version 3.7.3 and earlier provides a JMX management service without authentication by default. This allows privilege escalation by a malic… |
CVE-2023-28935 | High | 8.8 | 2023-03-30 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation… |
CVE-2023-28158 | Medium | 6.5 | 2023-03-29 | Privilege escalation via stored XSS using the file upload service to upload malicious content. The issue can be exploited only by authenticated users which can… |
CVE-2023-28326 | Critical | 9.8 | 2023-03-28 | Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.0.0 Description: Attacker can elevate their privileges in a… |
CVE-2023-25197 | Medium | 6.3 | 2023-03-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation apache fineract. Authorized us… |
CVE-2023-25196 | Medium | 4.3 | 2023-03-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation Apache Fineract. Authorized us… |
CVE-2023-25195 | High | 8.1 | 2023-03-28 | Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache Fineract. Authorized users with limited permissions can gain access to se… |
CVE-2023-27296 | High | 8.8 | 2023-03-27 | Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong. It could be triggered by authenticated users of InLong, you could… |
CVE-2022-47502 | High | 7.8 | 2023-03-24 | Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose. Links can… |
CVE-2022-38745 | High | 7.8 | 2023-03-24 | Apache OpenOffice versions before 4.1.14 may be configured to add an empty entry to the Java class path. This may lead to run arbitrary Java code from the curr… |
CVE-2023-28708 | Medium | 4.3 | 2023-03-22 | When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookie… |
CVE-2023-26513 | High | 7.5 | 2023-03-20 | Excessive Iteration vulnerability in Apache Software Foundation Apache Sling Resource Merger.This issue affects Apache Sling Resource Merger: from 1.2.0 before… |
CVE-2023-25695 | Medium | 5.3 | 2023-03-15 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: befo… |
CVE-2023-26464 | High | 7.5 | 2023-03-10 | ** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a… |
CVE-2023-23638 | Medium | 5.0 | 2023-03-08 | A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x versio… |
CVE-2023-27522 | High | 7.5 | 2023-03-07 | HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special ch… |
CVE-2023-25690 | Critical | 9.8 | 2023-03-07 | Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when m… |