Apache CVEs
3,088 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2023-49250Apache DolphinScheduler: Insecure TLS TrustManager used in HttpUtil
- CVE-2023-49109Remote Code Execution in Apache Dolphinscheduler
- CVE-2024-25710Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file
- CVE-2024-26308Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file
- CVE-2024-23952Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb (version range fix for CVE-2023-46104)
- CVE-2023-50291Apache Solr: System Property redaction logic inconsistency can lead to leaked passwords
- CVE-2023-50292Apache Solr: Solr Schema Designer blindly "trusts" all configsets, possibly leading to RCE by unauthenticated users
- CVE-2023-50298Apache Solr: Solr can expose ZooKeeper credentials via Streaming Expressions
- CVE-2023-50386Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets
- CVE-2024-23452Apache bRPC: HTTP request smuggling vulnerability
- CVE-2023-39196Apache Ozone: Missing mutual TLS authentication in one of the service internal Ozone Storage Container Manager endpoints
- CVE-2023-51437Apache Pulsar: Timing attack in SASL token signature verification
- CVE-2024-23673Apache Sling Servlets Resolver: Malicious code execution via path traversal
- CVE-2023-44313Apache ServiceComb Service-Center: attacker can perform SSRF through the frontend API
- CVE-2023-44312Apache ServiceComb Service-Center: attacker can query all environment variables of the service-center server
- CVE-2023-29055Apache Kylin: Insufficiently protected credentials in config file
- CVE-2023-50944Apache Airflow: Bypass permission verification to read code of other dags
- CVE-2023-50943Apache Airflow: Potential pickle deserialization vulnerability in XComs
- CVE-2023-51702Apache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer service
- CVE-2023-49657Apache Superset: Stored XSS in Dashboard Title and Chart Title
- CVE-2024-21733Apache Tomcat: Leaking of unrelated request bodies in default error page
- CVE-2023-46226Apache IoTDB: Remote Code Execution (RCE) risk via the UDF
- CVE-2023-46749Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting
- CVE-2023-50290Apache Solr: Host environment variables are published via the Metrics API
- CVE-2023-49619Apache Answer: Repeated submissions using scripts resulted in an abnormal number of collections for questions.
- CVE-2023-51441Apache Axis 1.x (EOL) may allow SSRF when untrusted input is passed to the service admin HTTP API
- CVE-2023-51784Apache InLong: Remote Code Execution vulnerability in Apache InLong Manager
- CVE-2023-51785Apache InLong: Arbitrary File Read Vulnerability in Apache InLong Manager
- CVE-2023-49299Apache DolphinScheduler: Arbitrary js execute as root for authenticated users
- CVE-2023-47804Apache OpenOffice: Macro URL arbitrary script execution