Apache CVEs
3,085 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2024-56512Apache NiFi: Missing Complete Authorization for Parameter and Service References
- CVE-2024-52046Apache MINA: MINA applications using unbounded deserialization may allow RCE
- CVE-2024-43441Apache HugeGraph-Server: Fixed JWT Token(Secret)
- CVE-2024-45387Apache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice_request_comments
- CVE-2024-23945Apache Hive, Apache Spark, Apache Spark: CookieSigner exposes the correct signature when message verification fails
- CVE-2024-56337Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incomplete
- CVE-2024-56128Apache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryption
- CVE-2024-54677Apache Tomcat: DoS in examples web application
- CVE-2024-50379Apache Tomcat: RCE due to TOCTOU issue in JSP compilation
- CVE-2024-55633Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access
- CVE-2024-53677Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks
- CVE-2024-53949Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled
- CVE-2024-53948Apache Superset: Error verbosity exposes metadata in analytics databases
- CVE-2024-53947Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
- CVE-2024-46901Apache Subversion: mod_dav_svn denial-of-service via control characters in paths
- CVE-2022-41137Apache Hive: Deserialization of untrusted data when fetching partitions from the Metastore
- CVE-2024-45106Apache Ozone: Improper authentication when generating S3 secrets
- CVE-2024-52338Apache Arrow R package: Arbitrary code execution when loading a malicious data file
- CVE-2024-51569Apache NimBLE: Lack of input sanitization leading to out-of-bound reads in Number of Completed Packets HCI event handler
- CVE-2024-47250Apache NimBLE: Lack of input validation in HCI advertising report could lead to potential out-of-bound access
- CVE-2024-47249Apache NimBLE: Lack of input sanitization leading to out-of-bound reads in multiple advertisement handler
- CVE-2024-47248Apache NimBLE: Buffer overflow in NimBLE MESH Bluetooth stack
- CVE-2024-45719Apache Answer: Predictable Authorization Token Using UUIDv1
- CVE-2024-52067Apache NiFi: Potential Insertion of Sensitive Parameter Values in Debug Log
- CVE-2024-31141Apache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProvider
- CVE-2024-52318Apache Tomcat: Incorrect JSP tag recycling leads to XSS
- CVE-2024-52317Apache Tomcat: Request/response mix-up with HTTP/2
- CVE-2024-52316Apache Tomcat: Authentication bypass when using Jakarta Authentication API
- CVE-2024-41151Apache HertzBeat: RCE by notice template injection vulnerability
- CVE-2024-45791Apache HertzBeat: Exposure sensitive token via http GET method with query string