Apache CVEs
3,088 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2023-47804Apache OpenOffice: Macro URL arbitrary script execution
- CVE-2023-51467Apache OFBiz: Pre-authentication Remote Code Execution (RCE) vulnerability
- CVE-2023-50968Apache OFBiz: Arbitrary file properties reading and SSRF attack
- CVE-2023-51656Apache IoTDB: Unsafe deserialize map in Sync Tool
- CVE-2023-48291Apache Airflow: Improper access control to DAG resources
- CVE-2023-50783Apache Airflow: Improper access control vulnerability on the "varimport" endpoint
- CVE-2023-47265Apache Airflow: DAG Params alllow to embed unchecked Javascript
- CVE-2023-49920Apache Airflow: Missing CSRF protection on DAG/trigger
- CVE-2023-37544Apache Pulsar WebSocket Proxy: Improper Authentication for WebSocket Proxy Endpoint Allows DoS
- CVE-2023-43826Apache Guacamole: Integer overflow in handling of VNC image buffers
- CVE-2023-49734Apache Superset: Privilege Escalation Vulnerability
- CVE-2023-49736Apache Superset: SQL Injection on where_in JINJA macro
- CVE-2023-46104Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb
- CVE-2023-41314Apache Doris: Missing API authentication allowed DoS
- CVE-2023-30867Apache StreamPark (incubating): Authenticated system users could trigger SQL injection vulnerability
- CVE-2023-49898Apache StreamPark (incubating): Authenticated system users could trigger remote command execution
- CVE-2023-46279Apache Dubbo: Bypass deny serialize list check in Apache Dubbo
- CVE-2023-29234Bypass serialize checks in Apache Dubbo
- CVE-2023-46750Apache Shiro: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Shiro.
- CVE-2023-45725Apache CouchDB, IBM Cloudant: Privilege Escalation Using _design Documents
- CVE-2023-50164Apache Struts: File upload component had a directory traversal vulnerability
- CVE-2023-41835Apache Struts: excessive disk usage
- CVE-2023-49070Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still present
- CVE-2023-49735Apache Tiles: Unvalidated input may lead to path traversal and XXE
- CVE-2023-49733Apache Cocoon's StreamGenerator is vulnerable to XXE injection
- CVE-2023-49620Apache DolphinScheduler: Authenticated users could delete UDFs in resource center they were not authorized for
- CVE-2022-45135Apache Cocoon: SQL injection in DatabaseCookieAuthenticatorAction
- CVE-2023-42504Apache Superset: Lack of rate limiting allows for possible denial of service
- CVE-2023-42505Apache Superset: Sensitive information disclosure on db connection details
- CVE-2023-42502Apache Superset: Open Redirect Vulnerability