Apache
Page 13 of 36 — Apache CVEs from a corpus of 3582, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-41107 | High | 8.1 | 2024-07-19 | The CloudStack SAML authentication (disabled by default) does not enforce signature check. In CloudStack environments where SAML authentication is enabled, an… |
CVE-2024-41172 | High | 7.5 | 2024-07-19 | In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit may prevent HTTPClient instances from b… |
CVE-2024-32007 | High | 7.5 | 2024-07-19 | An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform a denial of service a… |
CVE-2024-29736 | Critical | 9.1 | 2024-07-19 | A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attacker to perform SSRF style attacks on RE… |
CVE-2024-29178 | High | 8.8 | 2024-07-18 | On versions before 2.1.4, a user could log in and perform a template injection attack resulting in Remote Code Execution on the server, The attacker must succe… |
CVE-2024-40898 | High | 7.5 | 2024-07-18 | SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malic… |
CVE-2024-40725 | Medium | 5.3 | 2024-07-18 | A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based configuration of handlers. "AddTyp… |
CVE-2024-29120 | Medium | 5.9 | 2024-07-17 | In Streampark (version < 2.1.4), when a user logged in successfully, the Backend service would return "Authorization" as the front-end authentication credentia… |
CVE-2024-31411 | High | 8.8 | 2024-07-17 | Unrestricted Upload of File with dangerous type vulnerability in Apache StreamPipes. Such a dangerous type might be an executable file that may lead to a remot… |
CVE-2024-31979 | Medium | 4.3 | 2024-07-17 | Server-Side Request Forgery (SSRF) vulnerability in Apache StreamPipes during installation process of pipeline elements. Previously, StreamPipes allowed users… |
CVE-2024-30471 | Low | 3.7 | 2024-07-17 | Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache StreamPipes in user self-registration. This allows an attacker to potentially request… |
CVE-2024-29737 | Medium | 4.7 | 2024-07-17 | In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert comma… |
CVE-2023-52291 | Medium | 4.7 | 2024-07-17 | In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert comma… |
CVE-2024-39877 | High | 8.8 | 2024-07-17 | Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could exec… |
CVE-2024-39863 | Medium | 5.4 | 2024-07-17 | Apache Airflow versions before 2.9.3 have a vulnerability that allows an authenticated attacker to inject a malicious link when installing a provider. Users ar… |
CVE-2024-39887 | Medium | 4.3 | 2024-07-16 | An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-… |
CVE-2023-52290 | High | 8.1 | 2024-07-16 | In streampark-console the list pages(e.g: application pages), users can sort page by field. This sort field is sent from the front-end to the back-end, and the… |
CVE-2023-49566 | High | 8.8 | 2024-07-15 | In Apache Linkis <=1.5.0, due to the lack of effective filtering of parameters, an attacker configuring malicious db2 parameters in the DataSource Manager… |
CVE-2023-46801 | High | 8.8 | 2024-07-15 | In Apache Linkis <= 1.5.0, data source management module, when adding Mysql data source, exists remote code execution vulnerability for java version < 1.8.0_2… |
CVE-2023-41916 | Medium | 6.5 | 2024-07-15 | In Apache Linkis =1.4.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manag… |
CVE-2024-36522 | Critical | 9.8 | 2024-07-12 | The default configuration of XSLTResourceStream.java is vulnerable to remote code execution via XSLT injection when processing input from an untrusted source w… |
CVE-2024-37389 | Medium | 4.6 | 2024-07-08 | Apache NiFi 1.10.0 through 1.26.0 and 2.0.0-M1 through 2.0.0-M3 support a description field in the Parameter Context configuration that is vulnerable to cross-… |
CVE-2024-39864 | Critical | 9.8 | 2024-07-05 | The CloudStack integration API service allows running its unauthenticated API server (usually on port 8096 when configured and enabled via integration.api.port… |
CVE-2024-38346 | Critical | 9.8 | 2024-07-05 | The CloudStack cluster service runs on unauthenticated port (default 9090) that can be misused to run arbitrary commands on targeted hypervisors and CloudStack… |
CVE-2024-39884 | Medium | 6.2 | 2024-07-04 | A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar conf… |
CVE-2024-34750 | High | 7.5 | 2024-07-03 | Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not… |
CVE-2024-39573 | High | 7.5 | 2024-07-01 | Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to cause unsafe RewriteRules to unexpectedly setup URL's to be handle… |
CVE-2024-38477 | High | 7.5 | 2024-07-01 | null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request. Users are recomm… |
CVE-2024-38476 | Critical | 9.8 | 2024-07-01 | Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend application… |
CVE-2024-38475 | Critical | 9.1 | 2024-07-01 | Improper escaping of output in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted t… |
CVE-2024-38474 | Critical | 9.8 | 2024-07-01 | Substitution encoding issue in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configur… |
CVE-2024-38473 | High | 8.1 | 2024-07-01 | Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially… |
CVE-2024-38472 | High | 7.5 | 2024-07-01 | SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recomm… |
CVE-2024-36387 | Medium | 5.4 | 2024-07-01 | Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading pe… |
CVE-2024-29868 | Critical | 9.1 | 2024-06-24 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) vulnerability in Apache StreamPipes user self-registration and password recovery mechanism… |
CVE-2024-27136 | Medium | 6.1 | 2024-06-24 | XSS in Upload page in Apache JSPWiki 2.12.1 and priors allows the attacker to execute javascript in the victim's browser and get some sensitive information abo… |
CVE-2024-38379 | Medium | 4.8 | 2024-06-22 | Apache Allura's neighborhood settings are vulnerable to a stored XSS attack. Only neighborhood admins can access these settings, so the scope of risk is limit… |
CVE-2024-34693 | Medium | 6.8 | 2024-06-20 | Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with local_infile enabled. If b… |
CVE-2024-25142 | Medium | 5.5 | 2024-06-14 | Use of Web Browser Cache Containing Sensitive Information vulnerability in Apache Airflow. Airflow did not return "Cache-Control" header for dynamic content… |
CVE-2024-36265 | Critical | 9.8 | 2024-06-12 | ** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Submarine Server Core. This issue affects Apache Submarine Server Core: from 0… |
CVE-2024-36264 | Critical | 9.8 | 2024-06-12 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Authentication vulnerability in Apache Submarine Commons Utils. If the user doesn't explicitly set `submarine.auth.de… |
CVE-2024-36263 | High | 8.1 | 2024-06-12 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Submarine Server C… |
CVE-2024-36471 | High | 7.5 | 2024-06-10 | Import functionality is vulnerable to DNS rebinding attacks between verification and processing of the URL. Project administrators can run these imports, whic… |
CVE-2024-36104 | Critical | 9.1 | 2024-06-04 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14… |
CVE-2024-32077 | Medium | 5.4 | 2024-05-14 | Apache Airflow version 2.9.0 has a vulnerability that allows an authenticated attacker to inject malicious data into the task instance logs. Users are recomme… |
CVE-2024-34365 | Critical | 9.1 | 2024-05-14 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Input Validation vulnerability in Apache Karaf Cave.This issue affects all versions of Apache Karaf Cave. As this pro… |
CVE-2024-32113 | Critical | 9.8 | 2024-05-08 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13. … |
CVE-2024-26579 | Critical | 9.8 | 2024-05-08 | Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.7.0 through 1.11.0, the attackers can bypass using… |
CVE-2024-28148 | Medium | 4.3 | 2024-05-07 | An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request.This issue a… |
CVE-2023-35701 | Medium | 6.6 | 2024-05-03 | Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Hive. The vulnerability affects the Hive JDBC driver component and it can po… |
CVE-2024-32638 | Medium | 6.3 | 2024-05-02 | Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Apache APISIX when using `forward-auth` plugin.This issue affects Apac… |
CVE-2024-32114 | High | 8.5 | 2024-05-02 | In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It… |
CVE-2024-27349 | Critical | 9.1 | 2024-04-22 | Authentication Bypass by Spoofing vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0. Users are reco… |
CVE-2024-27348 | Critical | 9.8 | 2024-04-22 | RCE-Remote Command Execution vulnerability in Apache HugeGraph-Server.This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.3.0 in Java8 & Java11 Us… |
CVE-2024-27347 | Medium | 5.3 | 2024-04-22 | Server-Side Request Forgery (SSRF) vulnerability in Apache HugeGraph-Hubble.This issue affects Apache HugeGraph-Hubble: from 1.0.0 before 1.3.0. Users are rec… |
CVE-2024-29733 | Low | 2.7 | 2024-04-21 | Improper Certificate Validation vulnerability in Apache Airflow FTP Provider. The FTP hook lacks complete certificate validation in FTP_TLS connections, which… |
CVE-2024-29217 | Medium | 4.6 | 2024-04-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer.This issue affects Apache Answer: before 1… |
CVE-2024-31869 | Medium | 4.3 | 2024-04-18 | Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an authenticated user to see sensitive provider configuration via the "configuration" UI… |
CVE-2024-31391 | Medium | 6.5 | 2024-04-12 | Insertion of Sensitive Information into Log File vulnerability in the Apache Solr Operator. This issue affects all versions of the Apache Solr Operator from 0… |
CVE-2024-27309 | High | 7.4 | 2024-04-12 | While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not be correctly enforced. Two preconditions are ne… |
CVE-2024-31309 | High | 7.5 | 2024-04-10 | HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through 9… |
CVE-2024-31867 | Medium | 6.5 | 2024-04-09 | Improper Input Validation vulnerability in Apache Zeppelin. The attackers can execute malicious queries by setting improper configuration properties to LDAP s… |
CVE-2024-31868 | Medium | 6.1 | 2024-04-09 | Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin. The attackers can modify helium.json and exposure XSS attacks to normal users. This… |
CVE-2024-31866 | Critical | 9.8 | 2024-04-09 | Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin. The attackers can execute shell scripts or malicious code by overriding configuratio… |
CVE-2024-31865 | Medium | 6.5 | 2024-04-09 | Improper Input Validation vulnerability in Apache Zeppelin. The attackers can call updating cron API with invalid or improper privileges so that the notebook… |
CVE-2024-31864 | Critical | 9.8 | 2024-04-09 | Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Zeppelin. The attacker can inject sensitive configuration or malicious code… |
CVE-2024-31863 | Medium | 5.3 | 2024-04-09 | Authentication Bypass by Spoofing vulnerability by replacing to exsiting notes in Apache Zeppelin.This issue affects Apache Zeppelin: from 0.10.1 before 0.11.0… |
CVE-2024-31862 | Medium | 5.3 | 2024-04-09 | Improper Input Validation vulnerability in Apache Zeppelin when creating a new note from Zeppelin's UI.This issue affects Apache Zeppelin: from 0.10.1 before 0… |
CVE-2022-47894 | Medium | 5.3 | 2024-04-09 | Improper Input Validation vulnerability in Apache Zeppelin SAP.This issue affects Apache Zeppelin SAP: from 0.8.0 before 0.11.0. As this project is retired, w… |
CVE-2021-28656 | Medium | 5.4 | 2024-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in Credential page of Apache Zeppelin allows an attacker to submit malicious request. This issue affects Apach… |
CVE-2024-31860 | Medium | 6.5 | 2024-04-09 | Improper Input Validation vulnerability in Apache Zeppelin. By adding relative path indicators(E.g ..), attackers can see the contents for any files in the fi… |
CVE-2024-24746 | High | 7.5 | 2024-04-06 | Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache NimBLE. Specially crafted GATT operation can cause infinite loop in GATT serve… |
CVE-2024-27316 | High | 7.5 | 2024-04-04 | HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not sto… |
CVE-2024-24795 | Medium | 6.3 | 2024-04-04 | HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to ca… |
CVE-2023-38709 | High | 7.3 | 2024-04-04 | Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HT… |
CVE-2024-29008 | Medium | 6.4 | 2024-04-04 | A problem has been identified in the CloudStack additional VM configuration (extraconfig) feature which can be misused by anyone who has privilege to deploy a… |
CVE-2024-29007 | High | 7.3 | 2024-04-04 | The CloudStack management server and secondary storage VM could be tricked into making requests to restricted or random resources by means of following 301 HTT… |
CVE-2024-29006 | Critical | 9.8 | 2024-04-04 | By default the CloudStack management server honours the x-forwarded-for HTTP header and logs it as the source IP of an API request. This could lead to authenti… |
CVE-2024-29834 | Medium | 6.4 | 2024-04-02 | This vulnerability allows authenticated users with produce or consume permissions to perform unauthorized operations on partitioned topics, such as unloading t… |
CVE-2024-23539 | High | 8.3 | 2024-03-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Fineract.This issue affects Apache Fineract: <1.8… |
CVE-2024-23538 | Critical | 9.9 | 2024-03-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Fineract.This issue affects Apache Fineract: <1.8… |
CVE-2024-23537 | High | 8.4 | 2024-03-29 | Improper Privilege Management vulnerability in Apache Fineract.This issue affects Apache Fineract: <1.8.5. Users are recommended to upgrade to version 1.9.0… |
CVE-2024-29735 | Medium | 5.3 | 2024-03-26 | Improper Preservation of Permissions vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.8.2 through 2.8.3. Airflow's local file task han… |
CVE-2024-27438 | Critical | 9.8 | 2024-03-21 | Download of Code Without Integrity Check vulnerability in Apache Doris. The jdbc driver files used for JDBC catalog is not checked and may resulting in remote… |
CVE-2024-26307 | Medium | 5.3 | 2024-03-21 | Possible race condition vulnerability in Apache Doris. Some of code using `chmod()` method. This method run the risk of someone renaming the file out from unde… |
CVE-2024-29133 | Medium | 5.4 | 2024-03-21 | Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1. Users are recommend… |
CVE-2024-29131 | High | 7.3 | 2024-03-21 | Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1. Users are recommend… |
CVE-2024-27439 | Medium | 6.5 | 2024-03-19 | An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket. This issue affects Apache Wicket: from 9… |
CVE-2024-24683 | Medium | 6.5 | 2024-03-19 | Improper Input Validation vulnerability in Apache Hop Engine.This issue affects Apache Hop Engine: before 2.8.0. Users are recommended to upgrade to version 2… |
CVE-2024-28752 | Critical | 9.3 | 2024-03-15 | A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on we… |
CVE-2024-23944 | Medium | 5.3 | 2024-03-15 | Information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to monitor child znodes by attaching… |
CVE-2024-28746 | High | 8.1 | 2024-03-14 | Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variab… |
CVE-2024-24549 | High | 7.5 | 2024-03-13 | Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceed… |
CVE-2024-23672 | Medium | 6.3 | 2024-03-13 | Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to in… |
CVE-2024-28098 | Medium | 6.4 | 2024-03-12 | The vulnerability allows authenticated users with only produce or consume permissions to modify topic-level policies, such as retention, TTL, and offloading se… |
CVE-2024-27894 | High | 8.5 | 2024-03-12 | The Pulsar Functions Worker includes a capability that permits authenticated users to create functions where the function's implementation is referenced by a U… |
CVE-2024-27317 | High | 8.4 | 2024-03-12 | In Pulsar Functions Worker, authenticated users can upload functions in jar or nar files. These files, essentially zip files, are extracted by the Functions Wo… |
CVE-2024-27135 | High | 8.5 | 2024-03-12 | Improper input validation in the Pulsar Function Worker allows a malicious authenticated user to execute arbitrary Java code on the Pulsar Function worker, out… |
CVE-2022-34321 | High | 8.2 | 2024-03-12 | Improper Authentication vulnerability in Apache Pulsar Proxy allows an attacker to connect to the /proxy-stats endpoint without authentication. The vulnerable… |
CVE-2023-41313 | Critical | 9.8 | 2024-03-12 | The authentication method in Apache Doris versions before 2.0.0 was vulnerable to timing attacks. Users are recommended to upgrade to version 2.0.0 + or 1.2.8… |