Apache CVEs
3,087 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2024-40761Apache Answer: Avatar URL leaked user email addresses
- CVE-2024-39928Apache Linkis Spark EngineConn: Commons Lang's RandomStringUtils Random string security vulnerability
- CVE-2024-46544Apache Tomcat Connectors: mod_jk: local users can view and modify configuration
- CVE-2024-42323Apache HertzBeat: RCE by snakeYaml deser load malicious xml
- CVE-2024-45537Apache Druid: Users can provide MySQL JDBC properties not on allow list
- CVE-2024-45384Apache Druid: Padding oracle in druid-pac4j extension that allows an attacker to manipulate a pac4j session cookie via Padding Oracle Attack
- CVE-2024-22399Apache Seata: Remote Code Execution vulnerability via Hessian Deserialization in Apache Seata Server
- CVE-2024-45034Apache Airflow: Authenticated DAG authors could execute code on scheduler nodes
- CVE-2024-45498Apache Airflow: Command Injection in an example DAG
- CVE-2024-45195Apache OFBiz: Confused controller-view authorization logic (forced browsing)
- CVE-2024-45507Apache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCE
- CVE-2023-49582Apache Portable Runtime (APR): Unexpected lax shared memory permissions
- CVE-2024-41937Apache Airflow: Stored XSS Vulnerability on provider link
- CVE-2023-49198Apache SeaTunnel Web: Arbitrary file read vulnerability
- CVE-2024-22281Apache Helix Front (UI): Helix front hard-coded secret in the express-session
- CVE-2024-42362GHSL-2023-255: HertzBeat Authenticated (user role) RCE via unsafe deserialization in /api/monitors/import
- CVE-2024-42361GHSL-2023-256: HertzBeat Authenticated (guest role) SQL injection in /api/monitor/{monitorId}/metric/{metricFull}
- CVE-2024-43202Apache DolphinScheduler: Remote Code Execution Vulnerability
- CVE-2024-41909Apache MINA SSHD: integrity check bypass
- CVE-2024-41888Apache Answer: The link for resetting user password is not Single-Use
- CVE-2024-41890Apache Answer: The link to reset the user's password will remain valid after sending a new link
- CVE-2024-30188Apache DolphinScheduler: Resource File Read And Write Vulnerability
- CVE-2024-29831Apache DolphinScheduler: RCE by arbitrary js execution
- CVE-2024-42062Apache CloudStack: User Key Exposure to Domain Admins
- CVE-2024-42222Apache CloudStack: Unauthorised Network List Access
- CVE-2024-36448Apache IoTDB Workbench: SSRF Vulnerability (EOL)
- CVE-2024-38856Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code
- CVE-2024-42447Apache Airflow Providers FAB: FAB provider 1.2.1 and 1.2.0 did not let user to logout for Airflow
- CVE-2024-36268Apache InLong TubeMQ Client: Remote Code Execution vulnerability
- CVE-2024-27182Apache Linkis Basic management services: Engine material management Arbitrary file deletion vulnerability