Apache
Page 21 of 35 — Apache CVEs from a corpus of 3423, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-9484 | High | 7.0 | 2020-05-20 | When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the con… |
CVE-2020-1955 | Critical | 9.8 | 2020-05-20 | CouchDB version 3.0.0 shipped with a new configuration setting that governs access control to the entire database server called `require_valid_user_except_for_… |
CVE-2020-1960 | Medium | 4.7 | 2020-05-14 | A vulnerability in Apache Flink (1.1.0 to 1.1.5, 1.2.0 to 1.2.1, 1.3.0 to 1.3.3, 1.4.0 to 1.4.2, 1.5.0 to 1.5.6, 1.6.0 to 1.6.4, 1.7.0 to 1.7.2, 1.8.0 to 1.8.3… |
CVE-2020-1941 | Medium | 6.1 | 2020-05-14 | In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue. |
CVE-2020-11973 | Critical | 9.8 | 2020-05-14 | Apache Camel Netty enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgra… |
CVE-2020-11972 | Critical | 9.8 | 2020-05-14 | Apache Camel RabbitMQ enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should up… |
CVE-2020-11971 | High | 7.5 | 2020-05-14 | Apache Camel's JMX is vulnerable to Rebind Flaw. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.x, 3.0.0 up to 3.1.0 is affected. Users should upgrade to 3.2.0. |
CVE-2019-17572 | Medium | 5.3 | 2020-05-14 | In Apache RocketMQ 4.2.0 to 4.6.0, when the automatic topic creation in the broker is turned on by default, an evil topic like “../../../../topic2020” is sent… |
CVE-2019-17562 | Critical | 9.8 | 2020-05-14 | A buffer overflow vulnerability has been found in the baremetal component of Apache CloudStack. This applies to all versions prior to 4.13.1. The vulnerability… |
CVE-2020-1945 | Medium | 6.3 | 2020-05-14 | Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and… |
CVE-2020-1939 | Critical | 9.8 | 2020-05-12 | The Apache NuttX (Incubating) project provides an optional separate "apps" repository which contains various optional components and example programs. One of t… |
CVE-2018-1285 | Critical | 9.8 | 2020-05-11 | Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in appli… |
CVE-2020-1961 | Critical | 9.8 | 2020-05-04 | Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to 2.1.6, enabling at… |
CVE-2020-1959 | Critical | 9.8 | 2020-05-04 | A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary Java EL expressions, leading to an unau… |
CVE-2019-17557 | Medium | 5.4 | 2020-05-04 | It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the… |
CVE-2019-12425 | High | 7.5 | 2020-04-30 | Apache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary host |
CVE-2019-0235 | High | 8.8 | 2020-04-30 | Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks. |
CVE-2020-9482 | Medium | 6.5 | 2020-04-28 | If NiFi Registry 0.1.0 to 0.5.0 uses an authentication mechanism other than PKI, when the user clicks Log Out, NiFi Registry invalidates the authentication tok… |
CVE-2020-9481 | High | 7.5 | 2020-04-27 | Apache ATS 6.0.0 to 6.2.3, 7.0.0 to 7.1.9, and 8.0.0 to 8.0.6 is vulnerable to a HTTP/2 slow read attack. |
CVE-2020-1952 | Critical | 9.8 | 2020-04-27 | An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2. When starting IoTDB, the JMX port 31999 is exposed with no certification.Then, clients cou… |
CVE-2020-9488 | Low | 3.7 | 2020-04-27 | Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-mid… |
CVE-2020-9489 | Medium | 5.5 | 2020-04-27 | A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or i… |
CVE-2020-1964 | Critical | 9.8 | 2020-04-16 | It was noticed that Apache Heron 0.20.2-incubating, Release 0.20.1-incubating, and Release v-0.20.0-incubating does not configure its YAML parser to prevent th… |
CVE-2020-1927 | Medium | 6.1 | 2020-04-02 | In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and… |
CVE-2020-1958 | Medium | 6.5 | 2020-04-01 | When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.user… |
CVE-2019-17564 | Critical | 9.8 | 2020-04-01 | Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to com… |
CVE-2018-11802 | Medium | 4.3 | 2020-04-01 | In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node rece… |
CVE-2020-1954 | Medium | 5.3 | 2020-04-01 | Apache CXF has the ability to integrate with JMX by registering an InstrumentationManager extension with the CXF bus. If the ‘createMBServerConnectorFactory‘ p… |
CVE-2020-1934 | Medium | 5.3 | 2020-04-01 | In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server. |
CVE-2020-1949 | Medium | 6.1 | 2020-04-01 | Scripts in Sling CMS before 0.16.0 do not property escape the Sling Selector from URLs when generating navigational elements for the administrative consoles an… |
CVE-2020-1943 | Medium | 6.1 | 2020-04-01 | Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07. |
CVE-2019-17561 | High | 7.5 | 2020-03-30 | The "Apache NetBeans" autoupdate system does not fully validate code signatures. An attacker could modify the downloaded nbm and include additional code. "Apac… |
CVE-2019-17560 | Critical | 9.1 | 2020-03-30 | The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads. This allows an attacker to intercept downlo… |
CVE-2020-1957 | Critical | 9.8 | 2020-03-25 | Apache Shiro before 1.5.2, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass. |
CVE-2020-1944 | Critical | 9.8 | 2020-03-23 | There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and Transfer-Encoding and Content… |
CVE-2019-17565 | Critical | 9.8 | 2020-03-23 | There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and chunked encoding. Upgrade to v… |
CVE-2019-17559 | Critical | 9.8 | 2020-03-23 | There is a vulnerability in Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.8, and 8.0.0 to 8.0.5 with a smuggling attack and scheme parsing. Upgrade to ver… |
CVE-2020-1951 | Medium | 5.5 | 2020-03-23 | A carefully crafted or corrupt PSD file can cause an infinite loop in Apache Tika's PSDParser in versions 1.0-1.23. |
CVE-2020-1950 | Medium | 5.5 | 2020-03-23 | A carefully crafted or corrupt PSD file can cause excessive memory usage in Apache Tika's PSDParser in versions 1.0-1.23. |
CVE-2019-12416 | Medium | 6.1 | 2020-03-19 | we got reports for 2 injection attacks against the DeltaSpike windowhandler.js. This is only active if a developer selected the ClientSideWindowStrategy which… |
CVE-2019-10091 | High | 7.4 | 2020-03-16 | When TLS is enabled with ssl-endpoint-identification-enabled set to true, Apache Geode fails to perform hostname verification of the entries in the certificate… |
CVE-2020-1953 | Critical | 10.0 | 2020-03-13 | Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special s… |
CVE-2020-1947 | Critical | 9.8 | 2020-03-11 | In Apache ShardingSphere(incubator) 4.0.0-RC3 and 4.0.0, the ShardingSphere's web console uses the SnakeYAML library for parsing YAML inputs to load datasource… |
CVE-2011-2487 | Medium | 5.9 | 2020-03-11 | The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack. |
CVE-2019-14892 | Critical | 9.8 | 2020-03-02 | A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious obj… |
CVE-2015-2992 | Medium | 6.1 | 2020-02-27 | Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability. |
CVE-2020-1938 | Critical | 9.8 | 2020-02-24 | When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having hig… |
CVE-2020-1935 | Medium | 4.8 | 2020-02-24 | In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some… |
CVE-2019-17569 | Medium | 4.8 | 2020-02-24 | The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that… |
CVE-2020-1937 | High | 8.8 | 2020-02-24 | Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries. |
CVE-2014-4651 | Critical | 9.8 | 2020-02-18 | It was found that the jclouds scriptbuilder Statements class wrote a temporary file to a predictable location. An attacker could use this flaw to access sensit… |
CVE-2020-1942 | High | 7.5 | 2020-02-11 | In Apache NiFi 0.0.1 to 1.11.0, the flow fingerprint factory generated flow fingerprints which included sensitive property descriptor values. In the event a no… |
CVE-2020-5529 | High | 8.1 | 2020-02-11 | HtmlUnit prior to 2.37.0 contains code execution vulnerabilities. HtmlUnit initializes Rhino engine improperly, hence a malicious JavScript code can execute ar… |
CVE-2019-12426 | Medium | 5.3 | 2020-02-06 | an unauthenticated user could get access to information of some backend screens by invoking setSessionLocale in Apache OFBiz 16.11.01 to 16.11.06 |
CVE-2020-1931 | High | 8.1 | 2020-01-30 | A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration (.cf) files can be configured to run syste… |
CVE-2020-1930 | High | 8.1 | 2020-01-30 | A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious rule configuration (.cf) files can be configured to run… |
CVE-2019-20445 | Critical | 9.1 | 2020-01-29 | HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding hea… |
CVE-2020-1940 | High | 7.5 | 2020-01-28 | The optional initial password change and password expiration features present in Apache Jackrabbit Oak 1.2.0 to 1.22.0 are prone to a sensitive information dis… |
CVE-2020-1933 | Medium | 6.1 | 2020-01-28 | A XSS vulnerability was found in Apache NiFi 1.0.0 to 1.10.0. Malicious scripts could be injected to the UI through action by an unaware authenticated user in… |
CVE-2020-1932 | Medium | 6.5 | 2020-01-28 | An information disclosure issue was found in Apache Superset 0.34.0, 0.34.1, 0.35.0, and 0.35.1. Authenticated Apache Superset users are able to retrieve other… |
CVE-2020-1928 | Medium | 5.3 | 2020-01-28 | An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter parser would log parsed values for debugging purposes. This wo… |
CVE-2019-17570 | Critical | 9.8 | 2020-01-23 | An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malic… |
CVE-2019-17573 | Medium | 6.1 | 2020-01-16 | By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected C… |
CVE-2019-12423 | High | 7.5 | 2020-01-16 | Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the si… |
CVE-2020-1929 | High | 7.5 | 2020-01-15 | The Apache Beam MongoDB connector in versions 2.10.0 to 2.16.0 has an option to disable SSL trust verification. However this configuration is not respected and… |
CVE-2019-12398 | Medium | 4.8 | 2020-01-14 | In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to… |
CVE-2019-12399 | High | 7.5 | 2020-01-14 | When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is cr… |
CVE-2019-0219 | Critical | 9.8 | 2020-01-14 | A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a specially crafted gap-iab… |
CVE-2020-1925 | High | 7.5 | 2020-01-09 | Apache Olingo versions 4.0.0 to 4.7.0 provide the AsyncRequestWrapperImpl class which reads a URL from the Location header, and then sends a GET or DELETE requ… |
CVE-2020-5499 | Critical | 9.8 | 2020-01-04 | Baidu Rust SGX SDK through 1.0.8 has an enclave ID race. There are non-deterministic results in which, sometimes, two global IDs are the same. |
CVE-2014-0048 | Critical | 9.8 | 2020-01-02 | An issue was found in Docker before 1.6.0. Some programs and scripts in Docker are downloaded via HTTP and then executed or used in unsafe ways. |
CVE-2019-17558 | High | 7.5 | 2019-12-30 | Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided throug… |
CVE-2019-19924 | Medium | 5.3 | 2019-12-24 | SQLite 3.30.1 mishandles certain parser-tree rewriting, related to expr.c, vdbeaux.c, and window.c. This is caused by incorrect sqlite3WindowRewrite() error ha… |
CVE-2019-12418 | High | 7.0 | 2019-12-23 | When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access… |
CVE-2019-17563 | High | 7.5 | 2019-12-23 | When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could per… |
CVE-2019-17571 | Critical | 9.8 | 2019-12-20 | Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code… |
CVE-2012-5639 | Medium | 6.5 | 2019-12-20 | LibreOffice and OpenOffice automatically open embedded content |
CVE-2019-19906 | High | 7.5 | 2019-12-19 | cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The… |
CVE-2018-1311 | High | 8.1 | 2019-12-18 | The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed… |
CVE-2019-12414 | Medium | 5.3 | 2019-12-16 | In Apache Incubator Superset before 0.32, a user can view database names that he has no access to on a dropdown list in SQLLab |
CVE-2019-12413 | Medium | 5.3 | 2019-12-16 | In Apache Incubator Superset before 0.31 user could query database metadata information from a database he has no access to, by using a specially crafted compl… |
CVE-2014-0212 | High | 7.5 | 2019-12-13 | qpid-cpp: ACL policies only loaded if the acl-file option specified enabling DoS by consuming all available file descriptors |
CVE-2019-12420 | High | 7.5 | 2019-12-12 | In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the recommended… |
CVE-2018-11805 | Medium | 6.7 | 2019-12-12 | In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits can be injec… |
CVE-2019-19603 | High | 7.5 | 2019-12-09 | SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash. |
CVE-2012-1592 | High | 8.8 | 2019-12-05 | A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files. |
CVE-2019-17555 | High | 7.5 | 2019-12-04 | The AsyncResponseWrapperImpl class in Apache Olingo versions 4.0.0 to 4.6.0 reads the Retry-After header and passes it to the Thread.sleep() method without any… |
CVE-2019-17556 | Critical | 9.8 | 2019-12-04 | Apache Olingo versions 4.0.0 to 4.6.0 provide the AbstractService class, which is public API, uses ObjectInputStream and doesn't check classes being deserializ… |
CVE-2019-17554 | Medium | 5.5 | 2019-12-04 | The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with c… |
CVE-2016-1000104 | High | 8.8 | 2019-12-03 | A security Bypass vulnerability exists in the FcgidPassHeader Proxy in mod_fcgid through 2016-07-07. |
CVE-2011-2177 | High | 7.8 | 2019-11-27 | OpenOffice.org v3.3 allows execution of arbitrary code with the privileges of the user running the OpenOffice.org suite tools. |
CVE-2011-3600 | High | 7.5 | 2019-11-26 | The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable pa… |
CVE-2019-12421 | High | 8.8 | 2019-11-19 | When using an authentication mechanism other than PKI, when the user clicks Log Out in NiFi versions 1.0.0 to 1.9.2, NiFi invalidates the authentication token… |
CVE-2019-10083 | Medium | 5.3 | 2019-11-19 | When updating a Process Group via the API in NiFi versions 1.3.0 to 1.9.2, the response to the request includes all of its contents (at the top most level, not… |
CVE-2019-10080 | Medium | 6.5 | 2019-11-19 | The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file. The XML file has th… |
CVE-2019-12422 | High | 7.5 | 2019-11-18 | Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack. |
CVE-2019-12409 | Critical | 9.8 | 2019-11-18 | The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration option in the default solr.in.sh configura… |
CVE-2019-10070 | Medium | 6.1 | 2019-11-18 | Apache Atlas versions 0.8.3 and 1.1.0 were found vulnerable to Stored Cross-Site Scripting in the search functionality |
CVE-2019-10172 | High | 7.5 | 2019-11-18 | A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus ja… |
CVE-2009-5004 | Medium | 6.5 | 2019-11-09 | qpid-cpp 1.0 crashes when a large message is sent and the Digest-MD5 mechanism with a security layer is in use . |