Apache CVEs
3,087 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2024-45505Apache HertzBeat: Exists Native Deser RCE and file writing vulnerabilities
- CVE-2024-47208Apache OFBiz: URLs allowing remote use of Groovy expressions, leading to RCE
- CVE-2024-48962Apache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE)
- CVE-2024-45784Apache Airflow: Sensitive configuration values are not masked in the logs by default
- CVE-2024-50306Apache Traffic Server: Server process can fail to drop privilege
- CVE-2024-50305Apache Traffic Server: Valid Host field value can cause crashes
- CVE-2024-38479Apache Traffic Server: Cache key plugin is vulnerable to cache poisoning attack
- CVE-2024-50386Apache CloudStack: Directly downloaded templates can be used to abuse KVM-based infrastructure
- CVE-2024-50378Apache Airflow: Secrets not masked in UI when sensitive variables are set via Airflow cli
- CVE-2024-51504Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server
- CVE-2024-38286Apache Tomcat: Denial of Service
- CVE-2024-23590Apache Kylin: Session fixation in web interface
- CVE-2024-43383Apache Lucene.Net.Replicator: Remote Code Execution in Lucene.Net.Replicator
- CVE-2024-45477Apache NiFi: Improper Neutralization of Input in Parameter Description
- CVE-2024-45031Apache Syncope: Stored XSS in Console and Enduser
- CVE-2024-45219Apache CloudStack: Uploaded and registered templates and volumes can be used to abuse KVM-based infrastructure
- CVE-2024-45461Apache CloudStack Quota plugin: Access checks not enforced in Quota
- CVE-2024-45462Apache CloudStack: Incomplete session invalidation on web interface logout
- CVE-2024-45693Apache CloudStack: Request origin validation bypass makes account takeover possible
- CVE-2024-45217Apache Solr: ConfigSets created during a backup restore command are trusted implicitly
- CVE-2024-45216Apache Solr: Authentication bypass possible using a fake URL Path ending
- CVE-2023-50780Apache ActiveMQ Artemis: Authenticated users could perform RCE via Jolokia MBeans
- CVE-2024-46911Apache Roller: Weakness in CSRF protection allows privilege escalation
- CVE-2024-45720Apache Subversion: Command line argument injection on Windows platforms
- CVE-2024-28168Apache XML Graphics FOP: XML External Entity (XXE) Processing
- CVE-2024-47554Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader
- CVE-2024-47561Apache Avro Java SDK: Arbitrary Code Execution when reading Avro schema (Java SDK)
- CVE-2024-45772Apache Lucene Replicator: Security Vulnerability in Lucene Replicator - Deserialization Issue
- CVE-2024-47197Maven Archetype Plugin: Maven Archetype integration-test may package local settings into the published artifact, possibly containing credentials
- CVE-2024-23454Apache Hadoop: Temporary File Local Information Disclosure