Apache CVEs
3,087 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2024-29006Apache CloudStack: x-forwarded-for HTTP header parsed by default
- CVE-2024-29834Apache Pulsar: Improper Authorization For Namespace and Topic Management Endpoints
- CVE-2024-23537Apache Fineract: Under certain circumstances, this vulnerability allowed users, without specific permissions, to escalate their privileges to any role.
- CVE-2024-23538Apache Fineract: Under certain system configurations, the sqlSearch parameter was vulnerable to SQL injection attacks, potentially allowing attackers to manipulate database queries.
- CVE-2024-23539Apache Fineract: Under certain system configurations, the sqlSearch parameter for specific endpoints was vulnerable to SQL injection attacks, potentially allowing attackers to manipulate database queries.
- CVE-2024-29735Apache Airflow: Potentially harmful permission changing by log task handler
- CVE-2024-27438Apache Doris: Downloading arbitrary remote jar files resulting in remote command execution
- CVE-2024-26307Apache Doris: Possible race condition
- CVE-2024-29131Apache Commons Configuration: StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator()
- CVE-2024-29133Apache Commons Configuration: StackOverflowError calling ListDelimiterHandler.flatten(Object, int) with a cyclical object tree
- CVE-2024-27439Apache Wicket: Possible bypass of CSRF protection
- CVE-2024-24683Apache Hop Engine: ID isn't escaped when generating HTML
- CVE-2024-28752Apache CXF SSRF Vulnerability using the Aegis databinding
- CVE-2024-23944Apache ZooKeeper: Information disclosure in persistent watcher handling
- CVE-2024-28746Apache Airflow: Ignored Airflow Permissions
- CVE-2024-23672Apache Tomcat: WebSocket DoS with incomplete closing handshake
- CVE-2024-24549Apache Tomcat: HTTP/2 header handling DoS
- CVE-2024-27894Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS Proxying
- CVE-2024-27317Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification
- CVE-2024-27135Apache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code Execution
- CVE-2022-34321Apache Pulsar: Improper Authentication for Pulsar Proxy Statistics Endpoint
- CVE-2024-28098Apache Pulsar: Improper Authorization For Topic-Level Policy Management
- CVE-2023-41313Apache Doris: Timing Attack weakness
- CVE-2023-50740Apache Linkis DataSource: DataSource module Oracle SQL Database Password Logged
- CVE-2024-26580Apache InLong: Logged-in user could exploit an arbitrary file read vulnerability
- CVE-2024-27138Apache Archiva: disabling user registration is not effective
- CVE-2024-27139Apache Archiva: incorrect authentication potentially leading to account takeover
- CVE-2024-27140Apache Archiva: reflected XSS
- CVE-2023-50378Apache Ambari: Various XSS problems
- CVE-2024-26280Apache Airflow: Overly broad default permissions for Viewer/Ops (audit logs)