Apache
Page 18 of 40 — Apache CVEs from a corpus of 3918, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-47804 | High | 8.8 | 2023-12-29 | Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose. Links can… |
CVE-2023-51467 | Critical | 9.8 | 2023-12-26 | The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code |
CVE-2023-50968 | High | 7.5 | 2023-12-26 | Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations. The same uri… |
CVE-2023-51650 | High | 7.5 | 2023-12-22 | Hertzbeat is an open source, real-time monitoring system. Prior to version 1.4.1, Spring Boot permission configuration issues caused unauthorized access vulner… |
CVE-2023-51387 | High | 7.2 | 2023-12-22 | Hertzbeat is an open source, real-time monitoring system. Hertzbeat uses aviatorscript to evaluate alert expressions. The alert expressions are supposed to be… |
CVE-2022-39337 | High | 7.5 | 2023-12-22 | Hertzbeat is an open source, real-time monitoring system with custom-monitoring, high performance cluster, prometheus-like and agentless. Hertzbeat versions 1… |
CVE-2023-51656 | Critical | 9.8 | 2023-12-21 | Deserialization of Untrusted Data vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 0.13.0 through 0.13.4. Users are recommended to upgrade… |
CVE-2023-50783 | Medium | 6.5 | 2023-12-21 | Apache Airflow, versions before 2.8.0, is affected by a vulnerability that allows an authenticated user without the variable edit permission, to update a varia… |
CVE-2023-49920 | Medium | 6.5 | 2023-12-21 | Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation. As a result… |
CVE-2023-48291 | Medium | 4.3 | 2023-12-21 | Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a re… |
CVE-2023-47265 | Medium | 5.4 | 2023-12-21 | Apache Airflow, versions 2.6.0 through 2.7.3 has a stored XSS vulnerability that allows a DAG author to add an unbounded and not-sanitized javascript in the pa… |
CVE-2023-37544 | High | 7.5 | 2023-12-20 | Improper Authentication vulnerability in Apache Pulsar WebSocket Proxy allows an attacker to connect to the /pingpong endpoint without authentication. This is… |
CVE-2023-43826 | High | 7.5 | 2023-12-19 | Apache Guacamole 1.5.3 and older do not consistently ensure that values received from a VNC server will not result in integer overflow. If a user connects to a… |
CVE-2023-49736 | Medium | 6.5 | 2023-12-19 | A where_in JINJA macro allows users to specify a quote, which combined with a carefully crafted statement would allow for SQL injection in Apache Superset.This… |
CVE-2023-49734 | High | 7.7 | 2023-12-19 | An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts al… |
CVE-2023-46104 | Medium | 6.5 | 2023-12-19 | Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vu… |
CVE-2023-48795 | Medium | 5.9 | 2023-12-18 | The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks… |
CVE-2023-41314 | High | 8.2 | 2023-12-18 | The api /api/snapshot and /api/get_log_file would allow unauthenticated access. It could allow a DoS attack or get arbitrary files from FE node. Please upgrade… |
CVE-2023-49898 | High | 7.2 | 2023-12-15 | In streampark, there is a project module that integrates Maven's compilation capability. However, there is no check on the compilation parameters of Maven. all… |
CVE-2023-30867 | Medium | 4.9 | 2023-12-15 | In the Streampark platform, when users log in to the system and use certain features, some pages provide a name-based fuzzy search, such as job names, role nam… |
CVE-2023-46279 | Critical | 9.8 | 2023-12-15 | Deserialization of Untrusted Data vulnerability in Apache Dubbo.This issue only affects Apache Dubbo 3.1.5. Users are recommended to upgrade to the latest ver… |
CVE-2023-29234 | Critical | 9.8 | 2023-12-15 | A deserialization vulnerability existed when decode a malicious package.This issue affects Apache Dubbo: from 3.1.0 through 3.1.10, from 3.2.0 through 3.2.4. … |
CVE-2023-46750 | Medium | 6.1 | 2023-12-14 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro. Mitigation: Update to Apache Shiro 1.13.0… |
CVE-2023-45725 | Medium | 5.7 | 2023-12-13 | Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document. T… |
CVE-2023-50164 | Critical | 9.8 | 2023-12-07 | An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be u… |
CVE-2023-41835 | High | 7.5 | 2023-12-05 | When a Multipart request is performed but some of the fields exceed the maxStringLength limit, the upload files will remain in struts.multipart.saveDir even… |
CVE-2023-49070 | Critical | 9.8 | 2023-12-05 | Pre-auth RCE in Apache Ofbiz 18.12.09. It's due to XML-RPC no longer maintained still present. This issue affects Apache OFBiz: before 18.12.10. Users are re… |
CVE-2023-49735 | High | 7.5 | 2023-11-30 | ** UNSUPPORTED WHEN ASSIGNED ** The value set as the DefaultLocaleResolver.LOCALE_KEY attribute on the session was not validated while resolving XML definitio… |
CVE-2023-49733 | Critical | 9.8 | 2023-11-30 | Improper Restriction of XML External Entity Reference vulnerability in Apache Cocoon.This issue affects Apache Cocoon: from 2.2.0 before 2.3.0. Users are reco… |
CVE-2023-49620 | Medium | 6.5 | 2023-11-30 | Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unaut… |
CVE-2022-45135 | Critical | 9.8 | 2023-11-30 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Cocoon.This issue affects Apache Cocoon: from 2.2… |
CVE-2023-42504 | Medium | 5.8 | 2023-11-28 | An authenticated malicious user could initiate multiple concurrent requests, each requesting multiple dashboard exports, leading to a possible denial of servic… |
CVE-2023-42505 | Medium | 4.3 | 2023-11-28 | An authenticated user with read permissions on database connections metadata could potentially access sensitive information such as the connection's username. … |
CVE-2023-42502 | Medium | 4.8 | 2023-11-28 | An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be red… |
CVE-2023-46589 | High | 7.5 | 2023-11-28 | Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82… |
CVE-2022-41678 | High | 8.8 | 2023-11-28 | Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allows org.jolok… |
CVE-2023-49145 | High | 7.9 | 2023-11-27 | Apache NiFi 0.7.0 through 1.23.2 include the JoltTransformJSON Processor, which provides an advanced configuration user interface that is vulnerable to DOM-bas… |
CVE-2023-43701 | Medium | 4.3 | 2023-11-27 | Improper payload validation and an improper REST API response type, made it possible for an authenticated malicious actor to store malicious code into Chart's… |
CVE-2023-42501 | Medium | 4.3 | 2023-11-27 | Unnecessary read permissions within the Gamma role would allow authenticated users to read configured CSS templates and annotations. This issue affects Apache… |
CVE-2023-40610 | Medium | 6.3 | 2023-11-27 | Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection tha… |
CVE-2023-49068 | High | 7.5 | 2023-11-27 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.This issue affects Apache DolphinScheduler: before 3.2.1. … |
CVE-2023-48796 | High | 7.5 | 2023-11-24 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. The information exposed to unauthorized actors may includ… |
CVE-2023-43123 | Medium | 5.5 | 2023-11-23 | On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/dir… |
CVE-2023-37924 | Critical | 9.8 | 2023-11-22 | Apache Software Foundation Apache Submarine has an SQL injection vulnerability when a user logs in. This issue can result in unauthorized login. Now we have fi… |
CVE-2023-46302 | Critical | 9.8 | 2023-11-20 | Apache Software Foundation Apache Submarine has a bug when serializing against yaml. The bug is caused by snakeyaml https://nvd.nist.gov/vuln/detail/CVE-2022-… |
CVE-2022-46337 | Critical | 9.8 | 2023-11-20 | A cleverly devised username might bypass LDAP authentication checks. In LDAP-authenticated Derby installations, this could let an attacker fill up the disk b… |
CVE-2023-26031 | High | 7.5 | 2023-11-16 | Relative library resolution in linux container-executor binary in Apache Hadoop 3.3.1-3.3.4 on Linux allows local user to gain root privileges. If the YARN clu… |
CVE-2023-47037 | Medium | 4.3 | 2023-11-12 | We failed to apply CVE-2023-40611 in 2.7.1 and this vulnerability was marked as fixed then. Apache Airflow, versions before 2.7.3, is affected by a vulnerabi… |
CVE-2023-42781 | Medium | 6.5 | 2023-11-12 | Apache Airflow, versions before 2.7.3, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about… |
CVE-2023-47248 | Critical | 9.8 | 2023-11-09 | Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable… |
CVE-2023-39913 | High | 8.8 | 2023-11-08 | Deserialization of Untrusted Data, Improper Input Validation vulnerability in Apache UIMA Java SDK, Apache UIMA Java SDK, Apache UIMA Java SDK, Apache UIMA Jav… |
CVE-2023-46819 | Medium | 5.3 | 2023-11-07 | Missing Authentication in Apache Software Foundation Apache OFBiz when using the Solr plugin. This issue affects Apache OFBiz: before 18.12.09. Users are rec… |
CVE-2023-46851 | Medium | 4.9 | 2023-11-07 | Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments. Project administrators can run these imports, which could c… |
CVE-2023-46215 | High | 7.5 | 2023-10-28 | Insertion of Sensitive Information into Log File vulnerability in Apache Airflow Celery provider, Apache Airflow. Sensitive information logged as clear text w… |
CVE-2023-46604 | Critical | 10.0 | 2023-10-27 | The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a… |
CVE-2023-46288 | Medium | 4.3 | 2023-10-23 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.4.0 to 2.7.0. Sensitive co… |
CVE-2023-45802 | Medium | 5.9 | 2023-10-23 | When a HTTP/2 stream was reset (RST frame) by a client, there was a time window were the request's memory resources were not reclaimed immediately. Instead, de… |
CVE-2023-43622 | High | 7.5 | 2023-10-23 | An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. Th… |
CVE-2023-31122 | High | 7.5 | 2023-10-23 | Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57. |
CVE-2023-44483 | Medium | 6.5 | 2023-10-20 | All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a priva… |
CVE-2023-46227 | High | 7.5 | 2023-10-19 | Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong. This issue affects Apache InLong: from 1.4.0 through 1.8.0, the… |
CVE-2023-25753 | Medium | 6.5 | 2023-10-19 | There exists an SSRF (Server-Side Request Forgery) vulnerability located at the /sandbox/proxyGateway endpoint. This vulnerability allows us to manipulate arb… |
CVE-2023-41752 | High | 7.5 | 2023-10-17 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through… |
CVE-2023-39456 | High | 7.5 | 2023-10-17 | Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames.This issue affects Apache Traffic Server: from 9.0.0 through 9.2… |
CVE-2023-45757 | Medium | 6.1 | 2023-10-16 | Security vulnerability in Apache bRPC <=1.6.0 on all platforms allows attackers to inject XSS code to the builtin rpcz page. An attacker that can send http req… |
CVE-2023-43668 | Critical | 9.8 | 2023-10-16 | Authorization Bypass Through User-Controlled Key vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, some sensitive pa… |
CVE-2023-43667 | High | 7.5 | 2023-10-16 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache InLong.This issue affects Apache InL… |
CVE-2023-43666 | Medium | 6.5 | 2023-10-16 | Insufficient Verification of Data Authenticity vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, General user can vi… |
CVE-2023-45348 | Medium | 4.3 | 2023-10-14 | Apache Airflow, versions 2.7.0 and 2.7.1, is affected by a vulnerability that allows an authenticated user to retrieve sensitive configuration information when… |
CVE-2023-42792 | Medium | 6.5 | 2023-10-14 | Apache Airflow, in versions prior to 2.7.2, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a re… |
CVE-2023-42780 | Medium | 6.5 | 2023-10-14 | Apache Airflow, versions prior to 2.7.2, contains a security vulnerability that allows authenticated users of Airflow to list warnings for all DAGs, even if th… |
CVE-2023-42663 | Medium | 6.5 | 2023-10-14 | Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about… |
CVE-2023-44981 | Critical | 9.1 | 2023-10-11 | Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper (quorum.auth.ena… |
CVE-2023-37536 | High | 8.2 | 2023-10-11 | An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request. |
CVE-2023-45648 | Medium | 5.3 | 2023-10-10 | Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81… |
CVE-2023-42795 | Medium | 5.3 | 2023-10-10 | Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 th… |
CVE-2023-42794 | Medium | 5.9 | 2023-10-10 | Incomplete Cleanup vulnerability in Apache Tomcat. The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 throug… |
CVE-2023-44487 | High | 7.5 | 2023-10-10 | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the w… |
CVE-2023-39410 | High | 7.5 | 2023-09-29 | When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on… |
CVE-2023-41834 | Medium | 6.1 | 2023-09-19 | Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Flink Stateful Functions 3.1.0, 3.1.1 and 3.2.0 allows remote attackers to inject arbitrary… |
CVE-2023-42503 | Medium | 5.5 | 2023-09-14 | Improper Input Validation, Uncontrolled Resource Consumption vulnerability in Apache Commons Compress in TAR parsing.This issue affects Apache Commons Compress… |
CVE-2023-41267 | High | 7.8 | 2023-09-14 | In the Apache Airflow HDFS Provider, versions prior to 4.1.1, a documentation info pointed users to an install incorrect pip package. As this package name was… |
CVE-2023-41081 | High | 7.5 | 2023-09-13 | Important: Authentication Bypass CVE-2023-41081 The mod_jk component of Apache Tomcat Connectors in some circumstances, such as when a configuration included … |
CVE-2023-40712 | Medium | 6.5 | 2023-09-12 | Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a… |
CVE-2023-40611 | Medium | 4.3 | 2023-09-12 | Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail val… |
CVE-2023-39265 | Low | 3.8 | 2023-09-06 | Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite or… |
CVE-2023-37941 | Medium | 6.6 | 2023-09-06 | If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote cod… |
CVE-2023-32672 | Medium | 4.3 | 2023-09-06 | An Incorrect authorisation check in SQLLab in Apache Superset versions up to and including 2.1.0. This vulnerability allows an authenticated user to query tabl… |
CVE-2023-39264 | Medium | 4.3 | 2023-09-06 | By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists i… |
CVE-2023-36388 | Medium | 4.3 | 2023-09-06 | Improper REST API permission in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma users to test network connections, possible SSRF. |
CVE-2023-36387 | Medium | 5.4 | 2023-09-06 | An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user to test database co… |
CVE-2023-27526 | Medium | 4.3 | 2023-09-06 | A non Admin authenticated user could incorrectly create resources using the import charts feature, on Apache Superset up to and including 2.1.0. |
CVE-2023-27523 | Medium | 5.0 | 2023-09-06 | Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user to issue queries on… |
CVE-2023-40743 | Critical | 9.8 | 2023-09-05 | ** UNSUPPORTED WHEN ASSIGNED ** When integrating Apache Axis 1.x in an application, it may not have been obvious that looking up a service through "ServiceFact… |
CVE-2023-41180 | Medium | 5.9 | 2023-09-03 | Incorrect certificate validation in InvokeHTTP on Apache NiFi MiNiFi C++ versions 0.13 to 0.14 allows an intermediary to present a forged certificate during TL… |
CVE-2023-40195 | High | 8.8 | 2023-08-28 | Deserialization of Untrusted Data, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Software Foundation Apache Airflow Spark Pr… |
CVE-2023-27604 | High | 8.8 | 2023-08-28 | Apache Airflow Sqoop Provider, versions before 4.0.0, is affected by a vulnerability that allows an attacker pass parameters with the connections, which makes… |
CVE-2023-41080 | Medium | 6.1 | 2023-08-25 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1… |
CVE-2023-40273 | High | 8.0 | 2023-08-23 | The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by… |
CVE-2023-39441 | Medium | 5.9 | 2023-08-23 | Apache Airflow SMTP Provider before 1.3.0, Apache Airflow IMAP Provider before 3.3.0, and Apache Airflow before 2.7.0 are affected by the Validation of OpenSSL… |