Apache
Page 27 of 35 — Apache CVEs from a corpus of 3423, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-7662 | High | 8.8 | 2017-05-16 | Apache CXF Fediz ships with an OpenId Connect (OIDC) service which has a Client Registration Service, which is a simple web application that allows clients to… |
CVE-2017-7661 | High | 8.8 | 2017-05-16 | Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF (Cross Style Request Forgery) style vulnera… |
CVE-2017-5655 | Medium | 6.5 | 2017-05-15 | In Ambari 2.2.2 through 2.4.2 and Ambari 2.5.0, sensitive data may be stored on disk in temporary files on the Ambari Server host. The temporary files are read… |
CVE-2016-8741 | High | 7.5 | 2017-05-15 | The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user authentication. Among the choices are the S… |
CVE-2017-5654 | High | 7.5 | 2017-05-12 | In Ambari 2.4.x (before 2.4.3) and Ambari 2.5.0, an authorized user of the Ambari Hive View may be able to gain unauthorized read access to files on the host w… |
CVE-2016-6799 | High | 7.5 | 2017-05-09 | Product: Apache Cordova Android 5.2.2 and earlier. The application calls methods of the Log class. Messages passed to these methods (Log.v(), Log.d(), Log.i()… |
CVE-2016-4467 | Medium | 5.9 | 2017-05-02 | The C client and C-based client bindings in the Apache Qpid Proton library before 0.13.1 on Windows do not properly verify that the server hostname matches a d… |
CVE-2017-3162 | High | 7.3 | 2017-04-26 | HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace. The NameNode is provided as a query parameter that is not validated in Apach… |
CVE-2017-3161 | Medium | 6.1 | 2017-04-26 | The HDFS web UI in Apache Hadoop before 2.7.0 is vulnerable to a cross-site scripting (XSS) attack through an unescaped query parameter. |
CVE-2017-5656 | High | 7.5 | 2017-04-18 | Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker co… |
CVE-2017-5653 | Medium | 5.3 | 2017-04-18 | JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows re… |
CVE-2017-5662 | High | 7.3 | 2017-04-18 | In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG fil… |
CVE-2017-5661 | High | 7.3 | 2017-04-18 | In Apache FOP before 2.2, files lying on the filesystem of the server which uses FOP can be revealed to arbitrary users who send maliciously formed SVG files… |
CVE-2017-5645 | Critical | 9.8 | 2017-04-17 | In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially… |
CVE-2017-5659 | High | 7.5 | 2017-04-17 | Apache Traffic Server before 6.2.1 generates a coredump when there is a mismatch between content length and chunked encoding. |
CVE-2016-5396 | High | 7.5 | 2017-04-17 | Apache Traffic Server 6.0.0 to 6.2.0 are affected by an HPACK Bomb Attack. |
CVE-2017-5651 | Critical | 9.8 | 2017-04-17 | In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the… |
CVE-2017-5650 | High | 7.5 | 2017-04-17 | In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the handling of an HTTP/2 GOAWAY frame for a connection did not close streams associated with that… |
CVE-2017-5648 | Critical | 9.1 | 2017-04-17 | While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8… |
CVE-2017-5647 | High | 7.5 | 2017-04-17 | A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0… |
CVE-2016-4970 | High | 7.5 | 2017-04-13 | handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite l… |
CVE-2016-6808 | Critical | 9.8 | 2017-04-12 | Buffer overflow in Apache Tomcat Connectors (mod_jk) before 1.2.42. |
CVE-2016-0779 | Critical | 9.8 | 2017-04-11 | The EjbObjectInputStream class in Apache TomEE before 1.7.4 and 7.x before 7.0.0-M3 allows remote attackers to execute arbitrary code via a crafted serialized… |
CVE-2016-6811 | High | 8.8 | 2017-04-11 | In Apache Hadoop 2.x before 2.7.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user. |
CVE-2016-6805 | Medium | 5.9 | 2017-04-07 | Apache Ignite before 1.9 allows man-in-the-middle attackers to read arbitrary files via XXE in modified update-notifier documents. |
CVE-2016-8735 | Critical | 9.8 | 2017-04-06 | Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRe… |
CVE-2016-6809 | Critical | 9.8 | 2017-04-06 | Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. The issue exists because Tika invokes JMatIO to do native d… |
CVE-2017-5649 | High | 7.5 | 2017-04-04 | Apache Geode before 1.1.1, when a cluster has enabled security by setting the security-manager property, allows remote authenticated users with CLUSTER:READ bu… |
CVE-2017-5642 | Critical | 9.8 | 2017-04-03 | During installation of Ambari 2.4.0 through 2.4.2, Ambari Server artifacts are not created with proper ACLs. |
CVE-2016-4976 | Medium | 5.5 | 2017-03-29 | Apache Ambari 2.x before 2.4.0 includes KDC administrator passwords on the kadmin command line, which allows local users to obtain sensitive information via a… |
CVE-2014-3582 | Critical | 9.8 | 2017-03-29 | In Ambari 1.2.0 through 2.2.2, it may be possible to execute arbitrary system commands on the Ambari Server host while generating SSL certificates for hosts in… |
CVE-2016-6807 | Critical | 9.8 | 2017-03-28 | Custom commands may be executed on Ambari Agent (2.4.x, before 2.4.2) hosts without authorization, leading to unauthorized access to operations that may affect… |
CVE-2016-8749 | Critical | 9.8 | 2017-03-28 | Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks. |
CVE-2017-5644 | Medium | 5.5 | 2017-03-24 | Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an… |
CVE-2014-0229 | Medium | 6.5 | 2017-03-23 | Apache Hadoop 0.23.x before 0.23.11 and 2.x before 2.4.1, as used in Cloudera CDH 5.0.x before 5.0.2, do not check authorization for the (1) refreshNamenodes… |
CVE-2016-9775 | High | 7.8 | 2017-03-23 | The postrm script in the tomcat6 package before 6.0.45+dfsg-1~deb7u3 on Debian wheezy, before 6.0.45+dfsg-1~deb8u1 on Debian jessie, before 6.0.35-1ubuntu3.9 o… |
CVE-2016-9774 | High | 7.8 | 2017-03-23 | The postinst script in the tomcat6 package before 6.0.45+dfsg-1~deb7u4 on Debian wheezy, before 6.0.35-1ubuntu3.9 on Ubuntu 12.04 LTS and on Ubuntu 14.04 LTS… |
CVE-2016-6816 | High | 7.1 | 2017-03-20 | The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line pe… |
CVE-2017-5643 | High | 7.4 | 2017-03-16 | Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE. |
CVE-2016-8747 | High | 7.5 | 2017-03-14 | An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15 in reverse-proxy configurations. Http11InputBuffer.ja… |
CVE-2017-5638 | Critical | 9.8 | 2017-03-11 | The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation dur… |
CVE-2017-3159 | Critical | 9.8 | 2017-03-07 | Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability. De-serializing untrusted data can lead to security flaws. |
CVE-2016-1566 | Medium | 5.4 | 2017-02-02 | Cross-site scripting (XSS) vulnerability in the file browser in Guacamole 0.9.8 and 0.9.9, when file transfer is enabled to a location shared by multiple users… |
CVE-2016-6497 | High | 7.5 | 2017-01-18 | main/java/org/apache/directory/groovyldap/LDAP.java in the Groovy LDAP API in Apache allows attackers to conduct LDAP entry poisoning attacks by leveraging set… |
CVE-2015-3188 | Critical | 9.8 | 2017-01-13 | The UI daemon in Apache Storm 0.10.0 before 0.10.0-beta1 allows remote attackers to execute arbitrary code via unspecified vectors. |
CVE-2015-3271 | Medium | 5.3 | 2016-12-15 | Apache Tika server (aka tika-server) in Apache Tika 1.9 might allow remote attackers to read arbitrary files via the HTTP fileUrl header. |
CVE-2016-8740 | High | 7.5 | 2016-12-05 | The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header len… |
CVE-2016-5393 | High | 8.8 | 2016-11-29 | In Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3, a remote user who can authenticate with the HDFS NameNode can possibly run arbitrary commands with… |
CVE-2016-1000031 | Critical | 9.8 | 2016-10-25 | Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution |
CVE-2016-6325 | High | 7.8 | 2016-10-13 | The Tomcat package on Red Hat Enterprise Linux (RHEL) 5 through 7, JBoss Web Server 3.0, and JBoss EWS 2 uses weak permissions for (1) /etc/sysconfig/tomcat an… |
CVE-2016-5425 | High | 7.8 | 2016-10-13 | The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/li… |
CVE-2015-1832 | Critical | 9.1 | 2016-10-03 | XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-d… |
CVE-2016-5019 | Critical | 9.8 | 2016-10-03 | CoreResponseStateManager in Apache MyFaces Trinidad 1.0.0 through 1.0.13, 1.2.x before 1.2.15, 2.0.x before 2.0.2, and 2.1.x before 2.1.2 might allow attackers… |
CVE-2016-4436 | Critical | 9.8 | 2016-10-03 | Apache Struts 2 before 2.3.29 and 2.5.x before 2.5.1 allow attackers to have unspecified impact via vectors related to improper action name clean up. |
CVE-2016-1240 | High | 7.8 | 2016-10-03 | The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debian jessie and the tomcat6 and libtomcat6… |
CVE-2016-4978 | High | 7.2 | 2016-09-27 | The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ Art… |
CVE-2016-5395 | Medium | 4.8 | 2016-09-26 | Cross-site scripting (XSS) vulnerability in the create user functionality in the policy admin tool in Apache Ranger before 0.6.1 allows remote authenticated ad… |
CVE-2016-4464 | Critical | 9.8 | 2016-09-21 | The application plugins in Apache CXF Fediz 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured audience… |
CVE-2016-6801 | High | 8.8 | 2016-09-21 | Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6… |
CVE-2016-5017 | High | 8.1 | 2016-09-21 | Buffer overflow in the C cli shell in Apache Zookeeper before 3.4.9 and 3.5.x before 3.5.3, when using the "cmd:" batch mode syntax, allows attackers to have u… |
CVE-2016-6802 | High | 7.5 | 2016-09-20 | Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet context path. |
CVE-2016-3089 | Medium | 6.1 | 2016-08-19 | Cross-site scripting (XSS) vulnerability in the SWF panel in Apache OpenMeetings before 3.1.2 allows remote attackers to inject arbitrary web script or HTML vi… |
CVE-2016-0760 | High | 8.8 | 2016-08-19 | Multiple incomplete blacklist vulnerabilities in Apache Sentry before 1.7.0 allow remote authenticated users to execute arbitrary code via the (1) reflect, (2)… |
CVE-2016-0782 | Medium | 5.4 | 2016-08-05 | The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduc… |
CVE-2016-5000 | Medium | 5.5 | 2016-08-05 | The XLSX2CSV example in Apache POI before 3.14 allows remote attackers to read arbitrary files via a crafted OpenXML document containing an external entity dec… |
CVE-2016-1513 | High | 7.8 | 2016-08-05 | The Impress tool in Apache OpenOffice 4.1.2 and earlier allows remote attackers to cause a denial of service (out-of-bounds read or write) or execute arbitrary… |
CVE-2016-1238 | High | 7.8 | 2016-08-02 | (1) cpan/Archive-Tar/bin/ptar, (2) cpan/Archive-Tar/bin/ptardiff, (3) cpan/Archive-Tar/bin/ptargrep, (4) cpan/CPAN/scripts/cpan, (5) cpan/Digest-SHA/shasum, (6… |
CVE-2016-5005 | Medium | 4.8 | 2016-07-28 | Cross-site scripting (XSS) vulnerability in Apache Archiva 1.3.9 and earlier allows remote authenticated administrators to inject arbitrary web script or HTML… |
CVE-2016-4469 | High | 8.8 | 2016-07-28 | Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.3.9 and earlier allow remote attackers to hijack the authentication of administr… |
CVE-2016-5388 | High | 8.1 | 2016-07-19 | Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applica… |
CVE-2016-5387 | High | 8.1 | 2016-07-19 | The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in… |
CVE-2016-4974 | High | 7.5 | 2016-07-13 | Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS (AMQP 1.0) before 0.10.0 does not restrict the use of classes available on the classpath, which might allo… |
CVE-2016-4463 | High | 7.5 | 2016-07-08 | Stack-based buffer overflow in Apache Xerces-C++ before 3.1.4 allows context-dependent attackers to cause a denial of service via a deeply nested DTD. |
CVE-2016-4979 | High | 7.5 | 2016-07-06 | The Apache HTTP Server 2.4.18 through 2.4.20, when mod_http2 and mod_ssl are enabled, does not properly recognize the "SSLVerifyClient require" directive for H… |
CVE-2016-1546 | Medium | 5.9 | 2016-07-06 | The Apache HTTP Server 2.4.17 and 2.4.18, when mod_http2 is enabled, does not limit the number of simultaneous stream workers for a single HTTP/2 connection, w… |
CVE-2016-4465 | Medium | 5.3 | 2016-07-04 | The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of service via a null value… |
CVE-2016-4438 | Critical | 9.8 | 2016-07-04 | The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression. |
CVE-2016-4433 | High | 7.5 | 2016-07-04 | Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request. |
CVE-2016-4431 | High | 7.5 | 2016-07-04 | Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks by leveraging a default… |
CVE-2016-4430 | High | 8.8 | 2016-07-04 | Apache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via uns… |
CVE-2016-3092 | High | 7.5 | 2016-07-04 | The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x… |
CVE-2016-1182 | High | 8.2 | 2016-07-04 | ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross… |
CVE-2016-1181 | High | 8.1 | 2016-07-04 | ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute ar… |
CVE-2015-0899 | High | 7.5 | 2016-07-04 | The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page… |
CVE-2016-2174 | High | 7.2 | 2016-06-13 | SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows remote authenticated administrators to execute arbitrary SQL commands… |
CVE-2016-3085 | Medium | 6.5 | 2016-06-10 | Apache CloudStack 4.5.x before 4.5.2.1, 4.6.x before 4.6.2.1, 4.7.x before 4.7.1.1, and 4.8.x before 4.8.0.1, when SAML-based authentication is enabled and use… |
CVE-2016-3093 | Medium | 5.3 | 2016-06-07 | Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a deni… |
CVE-2016-3087 | Critical | 9.8 | 2016-06-07 | Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitr… |
CVE-2016-4437 | Critical | 9.8 | 2016-06-07 | Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass… |
CVE-2015-7611 | High | 8.1 | 2016-06-07 | Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspecified vectors. |
CVE-2016-4432 | Critical | 9.1 | 2016-06-01 | The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication and consequently p… |
CVE-2016-3094 | Medium | 5.9 | 2016-06-01 | PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allows remote attackers to cause a denial of… |
CVE-2016-3088 | Critical | 9.8 | 2016-06-01 | The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by a… |
CVE-2016-2175 | High | 7.8 | 2016-06-01 | Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External… |
CVE-2016-0731 | Medium | 4.9 | 2016-05-18 | The File Browser View in Apache Ambari before 2.2.1 allows remote authenticated administrators to read arbitrary files via a file: URL in the WebHDFS URL confi… |
CVE-2016-0707 | Low | 3.3 | 2016-05-18 | The agent in Apache Ambari before 2.1.2 uses weak permissions for the (1) /var/lib/ambari-agent/data and (2) /var/lib/ambari-agent/keys directories, which allo… |
CVE-2016-2099 | Critical | 9.8 | 2016-05-13 | Use-after-free vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 3.1.3 and earlier allows context-dependent attackers to have unspecified imp… |
CVE-2015-5208 | Medium | 4.4 | 2016-05-09 | Apache Cordova iOS before 4.0.0 allows remote attackers to execute arbitrary plugins via a link. |
CVE-2015-5207 | Medium | 5.3 | 2016-05-09 | Apache Cordova iOS before 4.0.0 might allow attackers to bypass a URL whitelist protection mechanism in an app and load arbitrary resources by leveraging unspe… |
CVE-2016-2168 | Medium | 6.5 | 2016-05-05 | The req_check_access function in the mod_authz_svn module in the httpd server in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4 allows remote authentic… |