Apache
Page 9 of 15 — Apache CVEs from a corpus of 1457, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-51941 | High | 8.8 | 2025-01-21 | A remote code injection vulnerability exists in the Ambari Metrics and AMS Alerts feature, allowing authenticated users to inject and execute arbitrary code… |
CVE-2024-45479 | Critical | 9.1 | 2025-01-21 | SSRF vulnerability in Edit Service Page of Apache Ranger UI in Apache Ranger Version 2.4.0. Users are recommended to upgrade to version Apache Ranger 2.5.0, wh… |
CVE-2024-45478 | Medium | 4.8 | 2025-01-21 | Stored XSS vulnerability in Edit Service Page of Apache Ranger UI in Apache Ranger Version 2.4.0. Users are recommended to upgrade to version Apache Ranger 2.5… |
CVE-2025-23184 | Medium | 5.9 | 2025-01-21 | A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream ins… |
CVE-2024-45627 | Medium | 5.9 | 2025-01-14 | In Apache Linkis <1.7.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manage… |
CVE-2025-22828 | Medium | 4.3 | 2025-01-13 | CloudStack users can add and read comments (annotations) on resources they are authorised to access. Due to an access validation issue that affects Apache Cl… |
CVE-2024-54676 | Critical | 9.8 | 2025-01-08 | Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0 Description: Default clustering instructions at https… |
CVE-2024-45033 | High | 8.1 | 2025-01-08 | Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider. This issue affects Apache Airflow Fab Provider: before 1.5.2. When user passwor… |
CVE-2024-56512 | Medium | 5.4 | 2024-12-28 | Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Contexts, referenced Controller Services, and referenced Paramet… |
CVE-2024-52046 | Critical | 9.8 | 2024-12-25 | The ObjectSerializationDecoder in Apache MINA uses Java’s native deserialization protocol to process incoming serialized data but lacks the necessary security… |
CVE-2024-43441 | Critical | 9.8 | 2024-12-24 | Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server. This issue affects Apache HugeGraph-Server: from 1.0.0 before 1.5.0… |
CVE-2024-45387 | Critical | 9.9 | 2024-12-23 | An SQL injection vulnerability in Traffic Ops in Apache Traffic Control <= 8.0.1, >= 8.0.0 allows a privileged user with role "admin", "federation", "operation… |
CVE-2024-23945 | Medium | 5.9 | 2024-12-23 | Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps p… |
CVE-2024-56337 | Critical | 9.8 | 2024-12-20 | Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0… |
CVE-2024-56128 | Medium | 5.3 | 2024-12-18 | Incorrect Implementation of Authentication Algorithm in Apache Kafka's SCRAM implementation. Issue Summary: Apache Kafka's implementation of the Salted Challe… |
CVE-2024-54677 | Medium | 5.3 | 2024-12-17 | Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service. This issue affects Apa… |
CVE-2024-50379 | Critical | 9.8 | 2024-12-17 | Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when th… |
CVE-2024-55633 | Medium | 6.5 | 2024-12-12 | Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML s… |
CVE-2024-53677 | Critical | 9.8 | 2024-12-11 | File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lea… |
CVE-2024-53949 | Medium | 6.5 | 2024-12-09 | Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use thi… |
CVE-2024-53948 | Medium | 5.3 | 2024-12-09 | Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recomme… |
CVE-2024-53947 | Critical | 9.8 | 2024-12-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific fu… |
CVE-2024-46901 | Low | 3.1 | 2024-12-09 | Insufficient validation of filenames against control characters in Apache Subversion repositories served via mod_dav_svn allows authenticated users with commit… |
CVE-2022-41137 | High | 8.3 | 2024-12-05 | Apache Hive Metastore (HMS) uses SerializationUtilities#deserializeObjectWithTypeInformation method when filtering and fetching partitions that is unsafe and c… |
CVE-2024-45106 | High | 8.1 | 2024-12-03 | Improper authentication of an HTTP endpoint in the S3 Gateway of Apache Ozone 1.4.0 allows any authenticated Kerberos user to revoke and regenerate the S3 secr… |
CVE-2024-52338 | Critical | 9.8 | 2024-11-28 | Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution. An ap… |
CVE-2024-51569 | High | 7.5 | 2024-11-26 | Out-of-bounds Read vulnerability in Apache NimBLE. Missing proper validation of HCI Number Of Completed Packets could lead to out-of-bound access when parsing… |
CVE-2024-47250 | Medium | 5.0 | 2024-11-26 | Out-of-bounds Read vulnerability in Apache NimBLE. Missing proper validation of HCI advertising report could lead to out-of-bound access when parsing HCI even… |
CVE-2024-47249 | Medium | 5.0 | 2024-11-26 | Improper Validation of Array Index vulnerability in Apache NimBLE. Lack of input validation for HCI events from controller could result in out-of-bound memory… |
CVE-2024-47248 | Medium | 6.3 | 2024-11-26 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBLE. Specially crafted MESH message could result in memory c… |
CVE-2024-45719 | Low | 2.6 | 2024-11-22 | Inadequate Encryption Strength vulnerability in Apache Answer. This issue affects Apache Answer: through 1.4.0. The ids generated using the UUID v1 version a… |
CVE-2024-52067 | Medium | 4.9 | 2024-11-21 | Apache NiFi 1.16.0 through 1.28.0 and 2.0.0-M1 through 2.0.0-M4 include optional debug logging of Parameter Context values during the flow synchronization proc… |
CVE-2018-9481 | Medium | 6.5 | 2024-11-20 | In bta_hd_set_report_act of bta_hd_act.cc, there is a possible out-of-bounds read due to an integer overflow. This could lead to remote information disclosure… |
CVE-2024-31141 | Medium | 6.5 | 2024-11-19 | Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients. Apache Kafka Clients accept configur… |
CVE-2024-52318 | Medium | 6.1 | 2024-11-18 | Incorrect object recycling and reuse vulnerability in Apache Tomcat. This issue affects Apache Tomcat: 11.0.0, 10.1.31, 9.0.96. Users are recommended to upgr… |
CVE-2024-52317 | Medium | 6.5 | 2024-11-18 | Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to r… |
CVE-2024-52316 | Critical | 9.8 | 2024-11-18 | Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext co… |
CVE-2024-48962 | High | 8.8 | 2024-11-18 | Improper Control of Generation of Code ('Code Injection'), Cross-Site Request Forgery (CSRF), : Improper Neutralization of Special Elements Used in a Template… |
CVE-2024-47208 | Critical | 9.8 | 2024-11-18 | Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz… |
CVE-2024-45791 | High | 7.5 | 2024-11-18 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat: before 1.6.1. Users are re… |
CVE-2024-45505 | High | 8.8 | 2024-11-18 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache HertzBeat (incubating). This vulnerability can onl… |
CVE-2024-41151 | High | 8.8 | 2024-11-18 | Deserialization of Untrusted Data vulnerability in Apache HertzBeat. This vulnerability can only be exploited by authorized attackers. This issue affects Ap… |
CVE-2024-45784 | High | 7.5 | 2024-11-15 | Apache Airflow versions before 2.10.3 contain a vulnerability that could expose sensitive configuration variables in task logs. This vulnerability allows DAG a… |
CVE-2024-50306 | Critical | 9.1 | 2024-11-14 | Unchecked return value can allow Apache Traffic Server to retain privileges on startup. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5, fr… |
CVE-2024-50305 | High | 7.5 | 2024-11-14 | Valid Host header field can cause Apache Traffic Server to crash on some platforms. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.5. Users… |
CVE-2024-38479 | High | 7.5 | 2024-11-14 | Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2… |
CVE-2024-50386 | High | 8.5 | 2024-11-12 | Account users in Apache CloudStack by default are allowed to register templates to be downloaded directly to the primary storage for deploying instances. Due t… |
CVE-2024-50378 | Medium | 4.9 | 2024-11-08 | Airflow versions before 2.10.3 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they shou… |
CVE-2024-51504 | Critical | 9.1 | 2024-11-07 | When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authent… |
CVE-2024-38286 | High | 8.6 | 2024-11-07 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from… |
CVE-2024-23590 | Critical | 9.1 | 2024-11-04 | Session Fixation vulnerability in Apache Kylin. This issue affects Apache Kylin: from 2.0.0 through 4.x. Users are recommended to upgrade to version 5.0.0 or… |
CVE-2024-43383 | High | 8.0 | 2024-10-31 | Deserialization of Untrusted Data vulnerability in Apache Lucene.Net.Replicator. This issue affects Apache Lucene.NET's Replicator library: from 4.8.0-beta000… |
CVE-2024-45477 | Medium | 4.6 | 2024-10-29 | Apache NiFi 1.10.0 through 1.27.0 and 2.0.0-M1 through 2.0.0-M3 support a description field for Parameters in a Parameter Context configuration that is vulnera… |
CVE-2024-45031 | Medium | 6.1 | 2024-10-24 | When editing objects in the Syncope Console, incomplete HTML tags could be used to bypass HTML sanitization. This made it possible to inject stored XSS payload… |
CVE-2024-45693 | High | 8.0 | 2024-10-16 | Users logged into the Apache CloudStack's web interface can be tricked to submit malicious CSRF requests due to missing validation of the origin of the request… |
CVE-2024-45462 | Medium | 6.3 | 2024-10-16 | The logout operation in the CloudStack web interface does not expire the user session completely which is valid until expiry by time or restart of the backend… |
CVE-2024-45461 | Medium | 5.7 | 2024-10-16 | The CloudStack Quota feature allows cloud administrators to implement a quota or usage limit system for cloud resources, and is disabled by default. In environ… |
CVE-2024-45219 | High | 8.5 | 2024-10-16 | Account users in Apache CloudStack by default are allowed to upload and register templates for deploying instances and volumes for attaching them as data disks… |
CVE-2024-45217 | High | 8.1 | 2024-10-16 | Insecure Default Initialization of Resource vulnerability in Apache Solr. New ConfigSets that are created via a Restore command, which copy a configSet from t… |
CVE-2024-45216 | Critical | 9.8 | 2024-10-16 | Improper Authentication vulnerability in Apache Solr. Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication i… |
CVE-2023-50780 | High | 8.8 | 2024-10-14 | Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint… |
CVE-2024-46911 | Medium | 4.7 | 2024-10-14 | Cross-site Resource Forgery (CSRF), Privilege escalation vulnerability in Apache Roller. On multi-blog/user Roller websites, by default weblog owners are trust… |
CVE-2024-45720 | High | 8.2 | 2024-10-09 | On Windows platforms, a "best fit" character encoding conversion of command line arguments to Subversion's executables (e.g., svn.exe, etc.) may lead to unexpe… |
CVE-2024-28168 | High | 7.5 | 2024-10-09 | Improper Restriction of XML External Entity Reference ('XXE') vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: 2.9. User… |
CVE-2024-47554 | Medium | 4.3 | 2024-10-03 | Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resour… |
CVE-2024-47561 | High | 7.3 | 2024-10-03 | Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to ver… |
CVE-2024-45772 | Medium | 5.1 | 2024-09-30 | Deserialization of Untrusted Data vulnerability in Apache Lucene Replicator. This issue affects Apache Lucene's replicator module: from 4.4.0 before 9.12.0. T… |
CVE-2024-47197 | High | 7.5 | 2024-09-26 | Exposure of Sensitive Information to an Unauthorized Actor, Insecure Storage of Sensitive Information vulnerability in Maven Archetype Plugin. This issue affe… |
CVE-2024-40761 | Medium | 5.3 | 2024-09-25 | Inadequate Encryption Strength vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. Using the MD5 value of a user's email to acce… |
CVE-2024-23454 | Medium | 6.2 | 2024-09-25 | Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. If sensitive data will be present in this file, all the other local u… |
CVE-2024-39928 | High | 7.5 | 2024-09-25 | In Apache Linkis <= 1.5.0, a Random string security vulnerability in Spark EngineConn, random string generated by the Token when starting Py4j uses the Commons… |
CVE-2024-46544 | Medium | 5.9 | 2024-09-23 | Incorrect Default Permissions vulnerability in Apache Tomcat Connectors allows local users to view and modify shared memory containing mod_jk configuration whi… |
CVE-2024-42323 | High | 8.8 | 2024-09-21 | SnakeYaml Deser Load Malicious xml rce vulnerability in Apache HertzBeat (incubating). This vulnerability can only be exploited by authorized attackers. This… |
CVE-2024-45537 | Medium | 6.5 | 2024-09-17 | Apache Druid allows users with certain permissions to read data from other database systems using JDBC. This functionality allows trusted users to set up Druid… |
CVE-2024-45384 | Medium | 5.3 | 2024-09-17 | Padding Oracle vulnerability in Apache Druid extension, druid-pac4j. This could allow an attacker to manipulate a pac4j session cookie. This issue affects Apa… |
CVE-2024-22399 | Critical | 9.8 | 2024-09-16 | Deserialization of Untrusted Data vulnerability in Apache Seata. When developers disable authentication on the Seata-Server and do not use the Seata client S… |
CVE-2024-45498 | High | 8.8 | 2024-09-07 | Example DAG: example_inlet_event_extra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows an authenticated attacker with only DAG tr… |
CVE-2024-45034 | High | 8.8 | 2024-09-07 | Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler… |
CVE-2024-45507 | Critical | 9.8 | 2024-09-04 | Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz… |
CVE-2024-45195 | High | 7.5 | 2024-09-04 | Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to versi… |
CVE-2023-49582 | Medium | 5.5 | 2024-08-26 | Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially r… |
CVE-2024-41937 | Medium | 6.1 | 2024-08-21 | Apache Airflow, versions before 2.10.0, have a vulnerability that allows the developer of a malicious provider to execute a cross-site scripting attack when cl… |
CVE-2023-49198 | High | 7.5 | 2024-08-21 | Mysql security vulnerability in Apache SeaTunnel. Attackers can read files on the MySQL server by modifying the information in the MySQL URL allowLoadLocalI… |
CVE-2024-22281 | High | 7.5 | 2024-08-20 | ** UNSUPPORTED WHEN ASSIGNED ** The Apache Helix Front (UI) component contained a hard-coded secret, allowing an attacker to spoof sessions by generating their… |
CVE-2024-42362 | High | 8.8 | 2024-08-20 | Hertzbeat is an open source, real-time monitoring system. Hertzbeat has an authenticated (user role) RCE via unsafe deserialization in /api/monitors/import. Th… |
CVE-2024-42361 | High | 7.5 | 2024-08-20 | Hertzbeat is an open source, real-time monitoring system. Hertzbeat 1.6.0 and earlier declares a /api/monitor/{monitorId}/metric/{metricFull} endpoint to downl… |
CVE-2024-43202 | Critical | 9.8 | 2024-08-20 | Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.2. We recommend users to upgrade Apache… |
CVE-2024-41909 | Medium | 5.9 | 2024-08-12 | Like many other SSH implementations, Apache MINA SSHD suffered from the issue that is more widely known as CVE-2023-48795. An attacker that can intercept traff… |
CVE-2024-41890 | Medium | 5.3 | 2024-08-12 | Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. User sends multiple pas… |
CVE-2024-41888 | Medium | 5.3 | 2024-08-12 | Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer: through 1.3.5. The password reset link… |
CVE-2024-30188 | High | 8.1 | 2024-08-12 | File read and write vulnerability in Apache DolphinScheduler , authenticated users can illegally access additional resource files. This issue affects Apache D… |
CVE-2024-29831 | High | 8.8 | 2024-08-12 | Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the ser… |
CVE-2024-42222 | Medium | 4.3 | 2024-08-07 | In Apache CloudStack 4.19.1.0, a regression in the network listing API allows unauthorised list access of network details for domain admin and normal user acco… |
CVE-2024-42062 | High | 7.2 | 2024-08-07 | CloudStack account-users by default use username and password based authentication for API and UI access. Account-users can generate and register randomised AP… |
CVE-2024-36448 | High | 7.3 | 2024-08-05 | ** UNSUPPORTED WHEN ASSIGNED ** Server-Side Request Forgery (SSRF) vulnerability in Apache IoTDB Workbench. This issue affects Apache IoTDB Workbench: from 0… |
CVE-2024-38856 | Critical | 9.8 | 2024-08-05 | Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.1… |
CVE-2024-42447 | Critical | 9.8 | 2024-08-05 | Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB. This issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache A… |
CVE-2024-36268 | Critical | 9.8 | 2024-08-02 | Improper Control of Generation of Code ('Code Injection') vulnerability in Apache InLong. This issue affects Apache InLong: from 1.10.0 through 1.12.0, which… |
CVE-2024-27182 | Medium | 4.9 | 2024-08-02 | In Apache Linkis <= 1.5.0, Arbitrary file deletion in Basic management services on A user with an administrator account could delete any file accessible by… |
CVE-2024-27181 | High | 8.8 | 2024-08-02 | In Apache Linkis <= 1.5.0, Privilege Escalation in Basic management services where the attacking user is a trusted account allows access to Linkis's Token… |