Apache
Page 15 of 36 — Apache CVEs from a corpus of 3582, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-49145 | High | 7.9 | 2023-11-27 | Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration user interface that is vulnerable to DOM-bas… |
CVE-2023-43701 | Medium | 4.3 | 2023-11-27 | Improper payload validation and an improper REST API response type, made it possible for an authenticated malicious actor to store malicious code into Chart's… |
CVE-2023-42501 | Medium | 4.3 | 2023-11-27 | Unnecessary read permissions within the Gamma role would allow authenticated users to read configured CSS templates and annotations. This issue affects Apache… |
CVE-2023-40610 | Medium | 6.3 | 2023-11-27 | Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection tha… |
CVE-2023-49068 | High | 7.5 | 2023-11-27 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.This issue affects Apache DolphinScheduler: before 3.2.1. … |
CVE-2023-48796 | High | 7.5 | 2023-11-24 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. The information exposed to unauthorized actors may includ… |
CVE-2023-43123 | Medium | 5.5 | 2023-11-23 | On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/dir… |
CVE-2023-37924 | Critical | 9.8 | 2023-11-22 | Apache Software Foundation Apache Submarine has an SQL injection vulnerability when a user logs in. This issue can result in unauthorized login. Now we have fi… |
CVE-2023-46302 | Critical | 9.8 | 2023-11-20 | Apache Software Foundation Apache Submarine has a bug when serializing against yaml. The bug is caused by snakeyaml https://nvd.nist.gov/vuln/detail/CVE-2022-… |
CVE-2022-46337 | Critical | 9.8 | 2023-11-20 | A cleverly devised username might bypass LDAP authentication checks. In LDAP-authenticated Derby installations, this could let an attacker fill up the disk b… |
CVE-2023-26031 | High | 7.5 | 2023-11-16 | Relative library resolution in linux container-executor binary in Apache Hadoop 3.3.1-3.3.4 on Linux allows local user to gain root privileges. If the YARN clu… |
CVE-2023-47037 | Medium | 4.3 | 2023-11-12 | We failed to apply CVE-2023-40611 in 2.7.1 and this vulnerability was marked as fixed then. Apache Airflow, versions before 2.7.3, is affected by a vulnerabi… |
CVE-2023-42781 | Medium | 6.5 | 2023-11-12 | Apache Airflow, versions before 2.7.3, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about… |
CVE-2023-47248 | Critical | 9.8 | 2023-11-09 | Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable… |
CVE-2023-39913 | High | 8.8 | 2023-11-08 | Deserialization of Untrusted Data, Improper Input Validation vulnerability in Apache UIMA Java SDK, Apache UIMA Java SDK, Apache UIMA Java SDK, Apache UIMA Jav… |
CVE-2023-46819 | Medium | 5.3 | 2023-11-07 | Missing Authentication in Apache Software Foundation Apache OFBiz when using the Solr plugin. This issue affects Apache OFBiz: before 18.12.09. Users are rec… |
CVE-2023-46851 | Medium | 4.9 | 2023-11-07 | Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments. Project administrators can run these imports, which could c… |
CVE-2023-46215 | High | 7.5 | 2023-10-28 | Insertion of Sensitive Information into Log File vulnerability in Apache Airflow Celery provider, Apache Airflow. Sensitive information logged as clear text w… |
CVE-2023-46604 | Critical | 10.0 | 2023-10-27 | The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a… |
CVE-2023-46288 | Medium | 4.3 | 2023-10-23 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.4.0 to 2.7.0. Sensitive co… |
CVE-2023-45802 | Medium | 5.9 | 2023-10-23 | When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de… |
CVE-2023-43622 | High | 7.5 | 2023-10-23 | An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. Th… |
CVE-2023-31122 | High | 7.5 | 2023-10-23 | Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57. |
CVE-2023-44483 | Medium | 6.5 | 2023-10-20 | All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a priva… |
CVE-2023-46227 | High | 7.5 | 2023-10-19 | Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong. This issue affects Apache InLong: from 1.4.0 through 1.8.0, the… |
CVE-2023-25753 | Medium | 6.5 | 2023-10-19 | There exists an SSRF (Server-Side Request Forgery) vulnerability located at the /sandbox/proxyGateway endpoint. This vulnerability allows us to manipulate arb… |
CVE-2023-41752 | High | 7.5 | 2023-10-17 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through… |
CVE-2023-39456 | High | 7.5 | 2023-10-17 | Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames.This issue affects Apache Traffic Server: from 9.0.0 through 9.2… |
CVE-2023-45757 | Medium | 6.1 | 2023-10-16 | Security vulnerability in Apache bRPC <=1.6.0 on all platforms allows attackers to inject XSS code to the builtin rpcz page. An attacker that can send http req… |
CVE-2023-43668 | Critical | 9.8 | 2023-10-16 | Authorization Bypass Through User-Controlled Key vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, some sensitive pa… |
CVE-2023-43667 | High | 7.5 | 2023-10-16 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache InLong.This issue affects Apache InL… |
CVE-2023-43666 | Medium | 6.5 | 2023-10-16 | Insufficient Verification of Data Authenticity vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, General user can vi… |
CVE-2023-45348 | Medium | 4.3 | 2023-10-14 | Apache Airflow, versions 2.7.0 and 2.7.1, is affected by a vulnerability that allows an authenticated user to retrieve sensitive configuration information when… |
CVE-2023-42792 | Medium | 6.5 | 2023-10-14 | Apache Airflow, in versions prior to 2.7.2, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a re… |
CVE-2023-42780 | Medium | 6.5 | 2023-10-14 | Apache Airflow, versions prior to 2.7.2, contains a security vulnerability that allows authenticated users of Airflow to list warnings for all DAGs, even if th… |
CVE-2023-42663 | Medium | 6.5 | 2023-10-14 | Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about… |
CVE-2023-44981 | Critical | 9.1 | 2023-10-11 | Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper (quorum.auth.ena… |
CVE-2023-37536 | High | 8.2 | 2023-10-11 | An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request. |
CVE-2023-45648 | Medium | 5.3 | 2023-10-10 | Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81… |
CVE-2023-42795 | Medium | 5.3 | 2023-10-10 | Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 th… |
CVE-2023-42794 | Medium | 5.9 | 2023-10-10 | Incomplete Cleanup vulnerability in Apache Tomcat. The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 throug… |
CVE-2023-44487 | High | 7.5 | 2023-10-10 | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the w… |
CVE-2023-39410 | High | 7.5 | 2023-09-29 | When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on… |
CVE-2023-41834 | Medium | 6.1 | 2023-09-19 | Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Flink Stateful Functions 3.1.0, 3.1.1 and 3.2.0 allows remote attackers to inject arbitrary… |
CVE-2023-42503 | Medium | 5.5 | 2023-09-14 | Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.This issue affects Apache Commons Compress… |
CVE-2023-41267 | High | 7.8 | 2023-09-14 | In the Apache Airflow HDFS Provider, versions prior to 4.1.1, a documentation info pointed users to an install incorrect pip package. As this package name was… |
CVE-2023-41081 | High | 7.5 | 2023-09-13 | Important: Authentication Bypass CVE-2023-41081 The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included … |
CVE-2023-40712 | Medium | 6.5 | 2023-09-12 | Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a… |
CVE-2023-40611 | Medium | 4.3 | 2023-09-12 | Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail val… |
CVE-2023-39265 | Low | 3.8 | 2023-09-06 | Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite or… |
CVE-2023-37941 | Medium | 6.6 | 2023-09-06 | If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote cod… |
CVE-2023-32672 | Medium | 4.3 | 2023-09-06 | An Incorrect authorisation check in SQLLab in Apache Superset versions up to and including 2.1.0. This vulnerability allows an authenticated user to query tabl… |
CVE-2023-39264 | Medium | 4.3 | 2023-09-06 | By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists i… |
CVE-2023-36388 | Medium | 4.3 | 2023-09-06 | Improper REST API permission in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma users to test network connections, possible SSRF. |
CVE-2023-36387 | Medium | 5.4 | 2023-09-06 | An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user to test database co… |
CVE-2023-27526 | Medium | 4.3 | 2023-09-06 | A non Admin authenticated user could incorrectly create resources using the import charts feature, on Apache Superset up to and including 2.1.0. |
CVE-2023-27523 | Medium | 5.0 | 2023-09-06 | Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user to issue queries on… |
CVE-2023-40743 | Critical | 9.8 | 2023-09-05 | ** UNSUPPORTED WHEN ASSIGNED ** When integrating Apache Axis 1.x in an application, it may not have been obvious that looking up a service through "ServiceFact… |
CVE-2023-41180 | Medium | 5.9 | 2023-09-03 | Incorrect certificate validation in InvokeHTTP on Apache NiFi MiNiFi C++ versions 0.13 to 0.14 allows an intermediary to present a forged certificate during TL… |
CVE-2023-40195 | High | 8.8 | 2023-08-28 | Deserialization of Untrusted Data, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Software Foundation Apache Airflow Spark Pr… |
CVE-2023-27604 | High | 8.8 | 2023-08-28 | Apache Airflow Sqoop Provider, versions before 4.0.0, is affected by a vulnerability that allows an attacker pass parameters with the connections, which makes… |
CVE-2023-41080 | Medium | 6.1 | 2023-08-25 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1… |
CVE-2023-40273 | High | 8.0 | 2023-08-23 | The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by… |
CVE-2023-39441 | Medium | 5.9 | 2023-08-23 | Apache Airflow SMTP Provider before 1.3.0, Apache Airflow IMAP Provider before 3.3.0, and Apache Airflow before 2.7.0 are affected by the Validation of OpenSSL… |
CVE-2023-37379 | High | 8.1 | 2023-08-23 | Apache Airflow, in versions prior to 2.7.0, contains a security vulnerability that can be exploited by an authenticated user possessing Connection edit privile… |
CVE-2022-44730 | Medium | 4.4 | 2023-08-22 | Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. A… |
CVE-2022-44729 | High | 7.1 | 2023-08-22 | Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. O… |
CVE-2022-46751 | High | 8.2 | 2023-08-21 | Improper Restriction of XML External Entity Reference, XML Injection (aka Blind XPath Injection) vulnerability in Apache Software Foundation Apache Ivy.This is… |
CVE-2023-40037 | Medium | 6.5 | 2023-08-18 | Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not p… |
CVE-2023-40272 | High | 7.5 | 2023-08-17 | Apache Airflow Spark Provider, versions before 4.1.3, is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing… |
CVE-2023-39553 | High | 7.5 | 2023-08-11 | Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider. Apache Airflow Drill Provider is affected by a vulnerabil… |
CVE-2023-33934 | Critical | 9.1 | 2023-08-09 | Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1. |
CVE-2022-47185 | High | 7.5 | 2023-08-09 | Improper input validation vulnerability on the range header in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: throu… |
CVE-2023-37581 | Medium | 5.4 | 2023-08-06 | Insufficient input validation and sanitation in Weblog Category name, Website About and File Upload features in all versions of Apache Roller on all platforms… |
CVE-2023-39508 | High | 8.8 | 2023-08-05 | Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow… |
CVE-2023-36542 | High | 8.8 | 2023-07-29 | Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authentica… |
CVE-2023-38647 | Critical | 9.8 | 2023-07-26 | An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngin… |
CVE-2023-38435 | Medium | 6.1 | 2023-07-25 | An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Apache Felix Healthcheck Webconsole Plugin ve… |
CVE-2023-37895 | Critical | 9.8 | 2023-07-25 | Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to (including) 2… |
CVE-2023-35088 | Critical | 9.8 | 2023-07-25 | Improper Neutralization of Special Elements Used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation Apache InLong.This issue affec… |
CVE-2023-34434 | High | 7.5 | 2023-07-25 | Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0. The a… |
CVE-2023-34189 | Medium | 6.5 | 2023-07-25 | Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0. The… |
CVE-2023-34478 | Critical | 9.8 | 2023-07-24 | Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with AP… |
CVE-2023-28754 | High | 8.8 | 2023-07-19 | Deserialization of Untrusted Data vulnerability in Apache ShardingSphere-Agent, which allows attackers to execute arbitrary code by constructing a special YAML… |
CVE-2023-26512 | Critical | 9.8 | 2023-07-17 | CWE-502 Deserialization of Untrusted Data at the rabbitmq-connector plugin module in Apache EventMesh (incubating) V1.7.0\V1.8.0 on windows\linux\mac os e.g. p… |
CVE-2023-37415 | High | 8.8 | 2023-07-13 | Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Apache Hive Provider. Patching on top of CVE-2023-35797 Before 6.1.2 the… |
CVE-2023-37582 | Critical | 9.8 | 2023-07-12 | The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1. W… |
CVE-2023-37579 | High | 8.2 | 2023-07-12 | Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Function Worker. This issue affects Apache Pulsar: before 2.10.4, and 2.11.0… |
CVE-2023-36543 | Medium | 6.5 | 2023-07-12 | Apache Airflow, versions before 2.6.3, has a vulnerability where an authenticated user can use crafted input to make the current request hang. It is recommende… |
CVE-2023-35908 | Medium | 6.5 | 2023-07-12 | Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows unauthorized read access to a DAG through the URL. It is recommended to upgra… |
CVE-2023-31007 | Unrated | | 2023-07-12 | Improper Authentication vulnerability in Apache Software Foundation Apache Pulsar Broker allows a client to stay connected to a broker after authentication dat… |
CVE-2023-30429 | Critical | 9.6 | 2023-07-12 | Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar. This issue affects Apache Pulsar: before 2.10.4, and 2.11.0. When a client… |
CVE-2023-30428 | High | 8.2 | 2023-07-12 | Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Broker's Rest Producer allows authenticated user with a custom HTTP header to… |
CVE-2023-22888 | Medium | 6.5 | 2023-07-12 | Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to cause a service disruption by manipulating the run_id paramete… |
CVE-2023-22887 | Medium | 6.5 | 2023-07-12 | Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to perform unauthorized file access outside the intended director… |
CVE-2022-46651 | Medium | 6.5 | 2023-07-12 | Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an unauthorized actor to gain access to sensitive information in Connection e… |
CVE-2022-45855 | High | 8.0 | 2023-07-12 | SpringEL injection in the metrics source in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. User… |
CVE-2022-42009 | High | 8.0 | 2023-07-12 | SpringEL injection in the server agent in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. Users… |
CVE-2023-32200 | High | 8.8 | 2023-07-12 | There is insufficient restrictions of called script functions in Apache Jena versions 4.8.0 and earlier. It allows a remote user to execute javascript via a… |
CVE-2023-35887 | Medium | 5.0 | 2023-07-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA. In SFTP servers implemented using Apache M… |