Apache
Page 14 of 15 — Apache CVEs from a corpus of 1457, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-25956 | High | 7.5 | 2023-02-24 | Generation of Error Message Containing Sensitive Information vulnerability in the Apache Airflow AWS Provider. This issue affects Apache Airflow AWS Provider… |
CVE-2023-25696 | Critical | 9.8 | 2023-02-24 | Improper Input Validation vulnerability in the Apache Airflow Hive Provider. This issue affects Apache Airflow Hive Provider versions before 5.1.3. |
CVE-2023-25693 | Critical | 9.8 | 2023-02-24 | Improper Input Validation vulnerability in the Apache Airflow Sqoop Provider. This issue affects Apache Airflow Sqoop Provider versions before 3.1.1. |
CVE-2023-25692 | High | 7.5 | 2023-02-24 | Improper Input Validation vulnerability in the Apache Airflow Google Provider. This issue affects Apache Airflow Google Provider versions before 8.10.0. |
CVE-2023-25691 | Critical | 9.8 | 2023-02-24 | Improper Input Validation vulnerability in the Apache Airflow Google Provider. This issue affects Apache Airflow Google Provider versions before 8.10.0. |
CVE-2023-25621 | Medium | 6.5 | 2023-02-23 | Privilege Escalation vulnerability in Apache Software Foundation Apache Sling. Any content author is able to create i18n dictionaries in the repository in a lo… |
CVE-2023-25613 | Critical | 9.8 | 2023-02-20 | An LDAP Injection vulnerability exists in the LdapIdentityBackend of Apache Kerby before 2.0.3. |
CVE-2023-24998 | High | 7.5 | 2023-02-20 | Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS wi… |
CVE-2022-42735 | High | 8.8 | 2023-02-15 | Improper Privilege Management vulnerability in Apache Software Foundation Apache ShenYu. ShenYu Admin allows low-privilege low-level administrators create us… |
CVE-2023-25141 | High | 7.5 | 2023-02-14 | Apache Sling JCR Base < 3.1.12 has a critical injection vulnerability when running on old JDK versions (JDK 1.8.191 or earlier) through utility functions in Re… |
CVE-2023-22832 | High | 7.5 | 2023-02-10 | The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references. Flow configurations that include the… |
CVE-2023-25194 | High | 8.8 | 2023-02-07 | A possible security vulnerability has been identified in Apache Kafka Connect API. This requires access to a Kafka Connect worker, and the ability to create/mo… |
CVE-2023-22849 | Medium | 6.1 | 2023-02-04 | An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.4 and prior may all… |
CVE-2022-45786 | High | 8.1 | 2023-02-04 | There are issues with the AGE drivers for Golang and Python that enable SQL injections to occur. This impacts AGE for PostgreSQL 11 & AGE for PostgreSQL 12, al… |
CVE-2023-24997 | Critical | 9.8 | 2023-02-01 | Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.5.0. Users a… |
CVE-2023-24977 | High | 7.5 | 2023-02-01 | Out-of-bounds Read vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.5.0. Users are advised to u… |
CVE-2022-28331 | Critical | 9.8 | 2023-01-31 | On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in apr_socket_sendv(). This is a result of integer overf… |
CVE-2022-25147 | Medium | 6.5 | 2023-01-31 | Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility (APR-util) allows an attacker to write beyond bounds of… |
CVE-2022-24963 | Critical | 9.8 | 2023-01-31 | Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. Th… |
CVE-2023-24829 | High | 8.8 | 2023-01-31 | Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component from 0.13.0 before 0.13.3… |
CVE-2022-44645 | High | 8.8 | 2023-01-31 | In Apache Linkis <=1.3.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attack… |
CVE-2022-44644 | Medium | 6.5 | 2023-01-31 | In Apache Linkis <=1.3.0 when used with the MySQL Connector/J in the data source module, an authenticated attacker could read arbitrary local files by connecti… |
CVE-2023-24830 | High | 7.5 | 2023-01-30 | Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects iotdb-web-workbench component: from 0.13.0 before 0.13.3. |
CVE-2023-22884 | Critical | 9.8 | 2023-01-21 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software… |
CVE-2022-37436 | Medium | 5.3 | 2023-01-17 | Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into… |
CVE-2022-36760 | Critical | 9.0 | 2023-01-17 | Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requ… |
CVE-2006-20001 | High | 7.5 | 2023-01-17 | A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent… |
CVE-2022-45438 | Medium | 5.3 | 2023-01-16 | When explicitly enabling the feature flag DASHBOARD_CACHE (disabled by default), the system allowed for an unauthenticated user to access dashboard configurati… |
CVE-2022-43721 | Medium | 5.4 | 2023-01-16 | An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could be redirected to this site when clickin… |
CVE-2022-43720 | Medium | 5.4 | 2023-01-16 | An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not get properly escaped by the toast messa… |
CVE-2022-43719 | High | 8.8 | 2023-01-16 | Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery. This issue affects Apache Superset version 1.5.2 an… |
CVE-2022-43718 | Medium | 5.4 | 2023-01-16 | Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by authenticated users with database connecti… |
CVE-2022-43717 | Medium | 5.4 | 2023-01-16 | Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vectors that can be performed by authentic… |
CVE-2022-41703 | Medium | 5.4 | 2023-01-16 | A vulnerability in the SQL Alchemy connector of Apache Superset allows an authenticated user with read access to a specific database to add subqueries to the W… |
CVE-2023-22602 | High | 7.5 | 2023-01-14 | When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication… |
CVE-2022-46769 | Medium | 5.4 | 2023-01-09 | An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.2 and prior may all… |
CVE-2022-45935 | Medium | 5.5 | 2023-01-06 | Usage of temporary files with insecure permissions by the Apache James server allows an attacker with local access to access private user data in transit. Vu… |
CVE-2022-45787 | Medium | 5.5 | 2023-01-06 | Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvider may lead to information disclosure to other local users. This issue a… |
CVE-2022-45875 | Critical | 9.8 | 2023-01-04 | Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability. This issue affects Apache Do… |
CVE-2022-45143 | High | 7.5 | 2023-01-03 | The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circ… |
CVE-2021-32824 | Critical | 9.8 | 2023-01-03 | Apache Dubbo is a java based, open source RPC framework. Versions prior to 2.6.10 and 2.7.10 are vulnerable to pre-auth remote code execution via arbitrary bea… |
CVE-2022-44621 | Critical | 9.8 | 2022-12-30 | Diagnosis Controller miss parameter validation, so user may attacked by command injection via HTTP Request. |
CVE-2022-43396 | High | 8.8 | 2022-12-30 | In the fix for CVE-2022-24697, a blacklist is used to filter user input commands. But there is a risk of being bypassed. The user can control the command by co… |
CVE-2022-45347 | Critical | 9.8 | 2022-12-22 | Apache ShardingSphere-Proxy prior to 5.3.0 when using MySQL as database backend didn't cleanup the database session completely after client authentication fail… |
CVE-2022-40145 | Critical | 9.8 | 2022-12-21 | This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL. The function jaas.modul… |
CVE-2022-46421 | Critical | 9.8 | 2022-12-20 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow Hive Provider.Th… |
CVE-2022-40743 | Medium | 6.1 | 2022-12-19 | Improper Input Validation vulnerability for the xdebug plugin in Apache Software Foundation Apache Traffic Server can lead to cross site scripting and cache po… |
CVE-2022-47500 | Medium | 6.1 | 2022-12-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Software Foundation Apache Helix UI component.This issue affects Apache Helix all r… |
CVE-2022-37392 | Medium | 5.3 | 2022-12-19 | Improper Check for Unusual or Exceptional Conditions vulnerability in handling the requests to Apache Traffic Server. This issue affects Apache Traffic Server… |
CVE-2022-32749 | High | 7.5 | 2022-12-19 | Improper Check for Unusual or Exceptional Conditions vulnerability handling requests in Apache Traffic Server allows an attacker to crash the server under cer… |
CVE-2022-46870 | Medium | 5.4 | 2022-12-16 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Zeppelin allows logged-in users to execute arbi… |
CVE-2021-28655 | Medium | 6.5 | 2022-12-16 | The improper Input Validation vulnerability in "”Move folder to Trash” feature of Apache Zeppelin allows an attacker to delete the arbitrary files. This issue… |
CVE-2022-32531 | Medium | 5.9 | 2022-12-15 | The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname verification fails… |
CVE-2022-34271 | High | 8.8 | 2022-12-14 | A vulnerability in import module of Apache Atlas allows an authenticated user to write to web server filesystem. This issue affects Apache Atlas versions from… |
CVE-2022-46364 | Critical | 9.8 | 2022-12-13 | A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perf… |
CVE-2022-46363 | High | 7.5 | 2022-12-13 | A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vulnerability… |
CVE-2022-45910 | Medium | 5.3 | 2022-12-07 | Improper neutralization of special elements used in an LDAP query ('LDAP Injection') vulnerability in ActiveDirectory and Sharepoint ActiveDirectory authority… |
CVE-2021-37533 | Medium | 6.5 | 2022-12-03 | Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use… |
CVE-2022-46366 | Critical | 9.8 | 2022-12-02 | Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. This issue is similar to but distinct from CVE-2020-17531, whic… |
CVE-2022-44635 | High | 8.8 | 2022-11-29 | Apache Fineract allowed an authenticated user to perform remote code execution due to a path traversal vulnerability in a file upload component of Apache Finer… |
CVE-2022-26885 | High | 7.5 | 2022-11-24 | When using tasks to read config files, there is a risk of database password disclosure. We recommend you upgrade to version 2.0.6 or higher. |
CVE-2022-45462 | Critical | 9.8 | 2022-11-23 | Alarm instance management has command injection when there is a specific command configured. It is only for logged-in users. We recommend you upgrade to versio… |
CVE-2022-41131 | High | 7.8 | 2022-11-22 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Hive Provider, Apache Airflow allows… |
CVE-2022-40954 | Medium | 5.5 | 2022-11-22 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Spark Provider, Apache Airflow allow… |
CVE-2022-40189 | Critical | 9.8 | 2022-11-22 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pig Provider, Apache Airflow allows… |
CVE-2022-38649 | Critical | 9.8 | 2022-11-22 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pinot Provider, Apache Airflow allow… |
CVE-2022-45470 | High | 7.5 | 2022-11-21 | missing input validation in Apache Hama may cause information disclosure through path traversal and XSS. Since Apache Hama is EOL, we do not expect these issue… |
CVE-2022-45047 | Critical | 9.8 | 2022-11-16 | Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.securi… |
CVE-2022-40309 | Medium | 4.3 | 2022-11-15 | Users with write permissions to a repository can delete arbitrary directories. |
CVE-2022-40308 | High | 7.5 | 2022-11-15 | If anonymous read enabled, it's possible to read the database file directly without logging in. |
CVE-2022-45402 | Medium | 6.1 | 2022-11-15 | In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's `/login` endpoint. |
CVE-2022-45136 | Critical | 9.8 | 2022-11-14 | Apache Jena SDB 3.17.0 and earlier is vulnerable to a JDBC Deserialisation attack if the attacker is able to control the JDBC URL used or cause the underlying… |
CVE-2022-45378 | Critical | 9.8 | 2022-11-14 | In the default configuration of Apache SOAP, an RPCRouterServlet is available without authentication. This gives an attacker the possibility to invoke methods… |
CVE-2022-40127 | High | 8.8 | 2022-11-14 | A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided r… |
CVE-2022-27949 | High | 7.5 | 2022-11-14 | A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for tasks which were not executed (for example… |
CVE-2022-37866 | High | 7.5 | 2022-11-07 | When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied "pattern" that may include placeholders… |
CVE-2022-42920 | Critical | 9.8 | 2022-11-07 | Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue… |
CVE-2022-37865 | Critical | 9.1 | 2022-11-07 | With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fly if they used pack200 or zip packaging… |
CVE-2022-33684 | High | 8.1 | 2022-11-04 | The Apache Pulsar C++ Client does not verify peer TLS certificates when making HTTPS calls for the OAuth2.0 Client Credential Flow, even when tlsAllowInsecureC… |
CVE-2022-32287 | High | 7.5 | 2022-11-03 | A relative path traversal vulnerability in a FileUtil class used by the PEAR management component of Apache UIMA allows an attacker to create files outside the… |
CVE-2022-43670 | Medium | 5.4 | 2022-11-02 | An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.0 and prior may all… |
CVE-2022-43985 | Medium | 6.1 | 2022-11-02 | In Apache Airflow versions prior to 2.4.2, there was an open redirect in the webserver's `/confirm` endpoint. |
CVE-2022-43982 | Medium | 6.1 | 2022-11-02 | In Apache Airflow versions prior to 2.4.2, the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument. |
CVE-2022-34662 | Medium | 6.5 | 2022-11-01 | When users add resources to the resource center with a relation path will cause path traversal issues and only for logged-in users. You could upgrade to versio… |
CVE-2022-31777 | Medium | 5.4 | 2022-11-01 | A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the… |
CVE-2022-42252 | High | 7.5 | 2022-11-01 | If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rej… |
CVE-2022-26884 | Medium | 6.5 | 2022-10-28 | Users can read any files by log server, Apache DolphinScheduler users should upgrade to version 2.0.6 or higher. |
CVE-2022-43766 | High | 7.5 | 2022-10-26 | Apache IoTDB version 0.12.2 to 0.12.6, 0.13.0 to 0.13.2 are vulnerable to a Denial of Service attack when accepting untrusted patterns for REGEXP queries with… |
CVE-2022-42468 | Critical | 9.8 | 2022-10-26 | Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with an unsafe provide… |
CVE-2022-39944 | High | 8.8 | 2022-10-26 | In Apache Linkis <=1.2.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attack… |
CVE-2022-42890 | High | 7.5 | 2022-10-25 | A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics p… |
CVE-2022-41704 | High | 7.5 | 2022-10-25 | A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue affects Apache XML Graphics prior to 1.16… |
CVE-2022-34870 | Medium | 5.4 | 2022-10-25 | Apache Geode versions up to 1.15.0 are vulnerable to a Cross-Site Scripting (XSS) via data injection when using Pulse web application to view Region entries. |
CVE-2021-42010 | Critical | 9.8 | 2022-10-24 | Heron versions <= 0.20.4-incubating allows CRLF log injection because of the lack of escaping in the log statements. Please update to version 0.20.5-incubating… |
CVE-2022-42467 | Medium | 5.3 | 2022-10-19 | When running in prototype mode, the h2 webconsole module (accessible from the Prototype menu) is automatically made available with the ability to directly quer… |
CVE-2022-42466 | Medium | 6.1 | 2022-10-19 | Prior to 2.0.0-M9, it was possible for an end-user to set the value of an editable string property of a domain object to a value that would be rendered unchang… |
CVE-2022-39198 | Critical | 9.8 | 2022-10-18 | A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution. This issue affects… |
CVE-2022-42889 | Critical | 9.8 | 2022-10-13 | Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${… |
CVE-2022-24697 | Critical | 9.8 | 2022-10-13 | Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu. RCE can be implem… |
CVE-2022-40664 | Critical | 9.8 | 2022-10-12 | Apache Shiro before 1.10.0, Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher. |