Apache
Page 19 of 40 — Apache CVEs from a corpus of 3918, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-37379 | High | 8.1 | 2023-08-23 | Apache Airflow, in versions prior to 2.7.0, contains a security vulnerability that can be exploited by an authenticated user possessing Connection edit privile… |
CVE-2022-44730 | Medium | 4.4 | 2023-08-22 | Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. A… |
CVE-2022-44729 | High | 7.1 | 2023-08-22 | Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. O… |
CVE-2022-46751 | High | 8.2 | 2023-08-21 | Improper Restriction of XML External Entity Reference, XML Injection (aka Blind XPath Injection) vulnerability in Apache Software Foundation Apache Ivy.This is… |
CVE-2023-40037 | Medium | 6.5 | 2023-08-18 | Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not p… |
CVE-2023-40272 | High | 7.5 | 2023-08-17 | Apache Airflow Spark Provider, versions before 4.1.3, is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing… |
CVE-2023-39553 | High | 7.5 | 2023-08-11 | Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider. Apache Airflow Drill Provider is affected by a vulnerabil… |
CVE-2023-33934 | Critical | 9.1 | 2023-08-09 | Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1. |
CVE-2022-47185 | High | 7.5 | 2023-08-09 | Improper input validation vulnerability on the range header in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: throu… |
CVE-2023-37581 | Medium | 5.4 | 2023-08-06 | Insufficient input validation and sanitation in Weblog Category name, Website About and File Upload features in all versions of Apache Roller on all platforms… |
CVE-2023-39508 | High | 8.8 | 2023-08-05 | Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow… |
CVE-2023-36542 | High | 8.8 | 2023-07-29 | Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authentica… |
CVE-2023-38647 | Critical | 9.8 | 2023-07-26 | An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngin… |
CVE-2023-38435 | Medium | 6.1 | 2023-07-25 | An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Apache Felix Healthcheck Webconsole Plugin ve… |
CVE-2023-37895 | Critical | 9.8 | 2023-07-25 | Java object deserialization issue in Jackrabbit webapp/standalone on all platforms allows attacker to remotely execute code via RMIVersions up to (including) 2… |
CVE-2023-35088 | Critical | 9.8 | 2023-07-25 | Improper Neutralization of Special Elements Used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation Apache InLong.This issue affec… |
CVE-2023-34434 | High | 7.5 | 2023-07-25 | Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0. The a… |
CVE-2023-34189 | Medium | 6.5 | 2023-07-25 | Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0. The… |
CVE-2023-34478 | Critical | 9.8 | 2023-07-24 | Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with AP… |
CVE-2023-28754 | High | 8.8 | 2023-07-19 | Deserialization of Untrusted Data vulnerability in Apache ShardingSphere-Agent, which allows attackers to execute arbitrary code by constructing a special YAML… |
CVE-2023-26512 | Critical | 9.8 | 2023-07-17 | CWE-502 Deserialization of Untrusted Data at the rabbitmq-connector plugin module in Apache EventMesh (incubating) V1.7.0\V1.8.0 on windows\linux\mac os e.g. p… |
CVE-2023-37415 | High | 8.8 | 2023-07-13 | Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Apache Hive Provider. Patching on top of CVE-2023-35797 Before 6.1.2 the… |
CVE-2023-37582 | Critical | 9.8 | 2023-07-12 | The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1. W… |
CVE-2023-37579 | High | 8.2 | 2023-07-12 | Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Function Worker. This issue affects Apache Pulsar: before 2.10.4, and 2.11.0… |
CVE-2023-36543 | Medium | 6.5 | 2023-07-12 | Apache Airflow, versions before 2.6.3, has a vulnerability where an authenticated user can use crafted input to make the current request hang. It is recommende… |
CVE-2023-35908 | Medium | 6.5 | 2023-07-12 | Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows unauthorized read access to a DAG through the URL. It is recommended to upgra… |
CVE-2023-31007 | Unrated | | 2023-07-12 | Improper Authentication vulnerability in Apache Software Foundation Apache Pulsar Broker allows a client to stay connected to a broker after authentication dat… |
CVE-2023-30429 | Critical | 9.6 | 2023-07-12 | Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar. This issue affects Apache Pulsar: before 2.10.4, and 2.11.0. When a client… |
CVE-2023-30428 | High | 8.2 | 2023-07-12 | Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Broker's Rest Producer allows authenticated user with a custom HTTP header to… |
CVE-2023-22888 | Medium | 6.5 | 2023-07-12 | Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to cause a service disruption by manipulating the run_id paramete… |
CVE-2023-22887 | Medium | 6.5 | 2023-07-12 | Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to perform unauthorized file access outside the intended director… |
CVE-2022-46651 | Medium | 6.5 | 2023-07-12 | Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an unauthorized actor to gain access to sensitive information in Connection e… |
CVE-2022-45855 | High | 8.0 | 2023-07-12 | SpringEL injection in the metrics source in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. User… |
CVE-2022-42009 | High | 8.0 | 2023-07-12 | SpringEL injection in the server agent in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. Users… |
CVE-2023-32200 | High | 8.8 | 2023-07-12 | There is insufficient restrictions of called script functions in Apache Jena versions 4.8.0 and earlier. It allows a remote user to execute javascript via a… |
CVE-2023-35887 | Medium | 5.0 | 2023-07-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA. In SFTP servers implemented using Apache M… |
CVE-2023-34442 | Low | 3.3 | 2023-07-10 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Camel.This issue affects Apache Camel: from 3.X t… |
CVE-2023-33008 | Medium | 5.3 | 2023-07-07 | Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache Johnzon. A malicious attacker can craft up some JSON input that uses lar… |
CVE-2023-34150 | Medium | 6.5 | 2023-07-05 | ** UNSUPPORTED WHEN ASSIGNED ** Use of TikaEncodingDetector in Apache Any23 can cause excessive memory usage. |
CVE-2023-35797 | Critical | 9.8 | 2023-07-03 | Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Hive Provider. This issue affects Apache Airflow Apache Hive Provider: bef… |
CVE-2023-22886 | High | 8.8 | 2023-06-29 | Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow JDBC Provider. Airflow JDBC Provider Connection’s [Connection URL] paramet… |
CVE-2023-35798 | Medium | 4.3 | 2023-06-27 | Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.This vulner… |
CVE-2023-34395 | High | 7.8 | 2023-06-27 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Software Foundation Apache Airflow ODBC Provider. In… |
CVE-2023-31469 | High | 8.8 | 2023-06-23 | A REST interface in Apache StreamPipes (versions 0.69.0 to 0.91.0) was not properly restricted to admin-only access. This allowed a non-admin user with valid… |
CVE-2023-34981 | High | 7.5 | 2023-06-21 | A regression in the fix for bug 66512 in Apache Tomcat 11.0.0-M5, 10.1.8, 9.0.74 and 8.5.88 meant that, if a response did not include any HTTP headers no AJP S… |
CVE-2023-34340 | Critical | 9.8 | 2023-06-21 | Improper Authentication vulnerability in Apache Software Foundation Apache Accumulo. This issue affects Apache Accumulo: 2.1.0. Accumulo 2.1.0 contains a defe… |
CVE-2023-35005 | Medium | 6.5 | 2023-06-19 | In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations. This vulnerability is mitigated by the fact configura… |
CVE-2023-34396 | Medium | 4.3 | 2023-06-14 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30… |
CVE-2023-34149 | Medium | 4.3 | 2023-06-14 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30… |
CVE-2023-33933 | High | 7.5 | 2023-06-14 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic… |
CVE-2023-30631 | High | 7.5 | 2023-06-14 | Improper Input Validation vulnerability in Apache Software Foundation Apache Traffic Server. The configuration option proxy.config.http.push_method_enabled di… |
CVE-2022-47184 | High | 7.5 | 2023-06-14 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic… |
CVE-2023-34468 | High | 8.8 | 2023-06-12 | The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configu… |
CVE-2023-34212 | Medium | 6.5 | 2023-06-12 | The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an auth… |
CVE-2023-30576 | Medium | 6.8 | 2023-06-07 | Apache Guacamole 0.9.10 through 1.5.1 may continue to reference a freed RDP audio input buffer. Depending on timing, this may allow an attacker to execute arbi… |
CVE-2023-30575 | Medium | 6.5 | 2023-06-07 | Apache Guacamole 1.5.1 and older may incorrectly calculate the lengths of instruction elements sent during the Guacamole protocol handshake, potentially allowi… |
CVE-2023-33234 | High | 7.2 | 2023-05-30 | Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection… |
CVE-2023-30601 | High | 7.8 | 2023-05-30 | Privilege escalation when enabling FQL/Audit logs allows user with JMX access to run arbitrary commands as the user running Apache Cassandra This issue affects… |
CVE-2022-46907 | Medium | 6.1 | 2023-05-25 | A carefully crafted request on several JSPWiki plugins could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascri… |
CVE-2023-33246 | Critical | 9.8 | 2023-05-24 | For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of RocketMQ, including NameS… |
CVE-2023-31103 | High | 7.5 | 2023-05-22 | Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Att… |
CVE-2023-31101 | Medium | 6.5 | 2023-05-22 | Insecure Default Initialization of Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.5.0 through 1.6… |
CVE-2023-31098 | Critical | 9.8 | 2023-05-22 | Weak Password Requirements vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.6.0. When users c… |
CVE-2023-31066 | Critical | 9.1 | 2023-05-22 | Files or Directories Accessible to External Parties vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 thro… |
CVE-2023-31065 | Critical | 9.1 | 2023-05-22 | Insufficient Session Expiration vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. An old… |
CVE-2023-31064 | High | 7.5 | 2023-05-22 | Files or Directories Accessible to External Parties vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 thro… |
CVE-2023-31062 | Critical | 9.8 | 2023-05-22 | Improper Privilege Management Vulnerabilities in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. When the… |
CVE-2023-31454 | High | 7.5 | 2023-05-22 | Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 th… |
CVE-2023-31453 | High | 7.5 | 2023-05-22 | Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 th… |
CVE-2023-31206 | High | 7.5 | 2023-05-22 | Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Atta… |
CVE-2023-31058 | High | 7.5 | 2023-05-22 | Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. Attacke… |
CVE-2023-28709 | High | 7.5 | 2023-05-22 | The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTT… |
CVE-2022-47937 | Critical | 9.8 | 2023-05-15 | Improper input validation in the Apache Sling Commons JSON bundle allows an attacker to trigger unexpected errors by supplying specially-crafted input. The or… |
CVE-2023-29246 | High | 7.2 | 2023-05-12 | An attacker who has gained access to an admin account can perform RCE via null-byte injection Vendor: The Apache Software Foundation Versions Affected: Apach… |
CVE-2023-29032 | High | 8.1 | 2023-05-12 | An attacker that has gained access to certain private information can use this to act as other user. Vendor: The Apache Software Foundation Versions Affected… |
CVE-2023-28936 | Medium | 5.3 | 2023-05-12 | Attacker can access arbitrary recording/room Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0 |
CVE-2023-25754 | Critical | 9.8 | 2023-05-08 | Privilege Context Switching Error vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: before 2.6.0. |
CVE-2023-29247 | Medium | 5.4 | 2023-05-08 | Task instance details page in the UI is vulnerable to a stored XSS.This issue affects Apache Airflow: before 2.6.0. |
CVE-2023-31039 | Critical | 9.8 | 2023-05-08 | Security vulnerability in Apache bRPC <1.5.0 on all platforms allows attackers to execute arbitrary code via ServerOptions::pid_file. An attacker that can infl… |
CVE-2023-31038 | High | 8.8 | 2023-05-08 | SQL injection in Log4cxx when using the ODBC appender to send log messages to a database. No fields sent to the database were properly escaped for SQL injecti… |
CVE-2022-45048 | High | 8.4 | 2023-05-05 | Authenticated users with appropriate privileges can create policies having expressions that can exploit code execution vulnerability. This issue affects Apache… |
CVE-2021-40331 | High | 8.1 | 2023-05-05 | An Incorrect Permission Assignment for Critical Resource vulnerability was found in the Apache Ranger Hive Plugin. Any user with SELECT privilege on a database… |
CVE-2023-26268 | Medium | 4.4 | 2023-05-02 | Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document fu… |
CVE-2023-32007 | High | 8.8 | 2023-05-02 | ** UNSUPPORTED WHEN ASSIGNED ** The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authenticatio… |
CVE-2022-46365 | Critical | 9.1 | 2023-05-01 | Apache StreamPark 1.0.0 before 2.0.0 When the user successfully logs in, to modify his profile, the username will be passed to the server-layer as a parameter… |
CVE-2022-45802 | Critical | 9.8 | 2023-05-01 | Streampark allows any users to upload a jar as application, but there is no mandatory verification of the uploaded file type, causing users to upload some high… |
CVE-2022-45801 | Medium | 5.4 | 2023-05-01 | Apache StreamPark 1.0.0 to 2.0.0 have a LDAP injection vulnerability. LDAP Injection is an attack used to exploit web based applications that construct LDAP st… |
CVE-2023-22665 | Medium | 5.4 | 2023-04-25 | There is insufficient checking of user queries in Apache Jena versions 4.7.0 and earlier, when invoking custom scripts. It allows a remote user to execute arbi… |
CVE-2023-30776 | Medium | 4.9 | 2023-04-24 | An authenticated user with specific data permissions could access database connections stored passwords by requesting a specific REST API. This issue affects A… |
CVE-2023-27524 | High | 8.9 | 2023-04-24 | Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY accordi… |
CVE-2023-25601 | Medium | 4.3 | 2023-04-20 | On version 3.0.0 through 3.1.1, Apache DolphinScheduler's python gateway suffered from improper authentication: an attacker could use a socket bytes attack wit… |
CVE-2023-27525 | Low | 3.1 | 2023-04-17 | An authenticated user with Gamma role authorization could have access to metadata information using non trivial methods in Apache Superset up to and including… |
CVE-2023-25504 | Medium | 4.9 | 2023-04-17 | A malicious actor who has been authenticated and granted specific permissions in Apache Superset may use the import dataset feature in order to conduct Server-… |
CVE-2023-30771 | Critical | 9.8 | 2023-04-17 | Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component on 0.13.3. iotdb-web-work… |
CVE-2023-22946 | Medium | 6.4 | 2023-04-17 | In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute… |
CVE-2023-24831 | Critical | 9.8 | 2023-04-17 | Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects Apache IoTDB Grafana Connector: from 0.13.0 through 0.13.3… |
CVE-2022-47501 | High | 7.5 | 2023-04-14 | Arbitrary file reading vulnerability in Apache Software Foundation Apache OFBiz when using the Solr plugin. This is a pre-authentication attack. This issue af… |
CVE-2022-45064 | High | 8.0 | 2023-04-13 | The SlingRequestDispatcher doesn't correctly implement the RequestDispatcher API resulting in a generic type of include-based cross-site scripting issues on th… |
CVE-2023-30465 | Medium | 5.3 | 2023-04-11 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation Apache InLong.This issue affec… |
CVE-2023-29216 | Critical | 9.8 | 2023-04-10 | In Apache Linkis <=1.3.1, because the parameters are not effectively filtered, the attacker uses the MySQL data source and malicious parameters to configure a… |