Apache CVEs
3,093 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2023-27604Apache Airflow Sqoop Provider: Airflow Sqoop Provider RCE Vulnerability
- CVE-2023-41080Apache Tomcat: Open redirect with FORM authentication
- CVE-2023-39441Apache Airflow SMTP Provider, Apache Airflow IMAP Provider, Apache Airflow: SMTP/IMAP client components allowed MITM due to missing Certificate Validation
- CVE-2023-37379Apache Airflow: Exposure of sensitive connection information, DOS and SSRF on "test connection" feature
- CVE-2023-40273Session fixation in Apache Airflow web interface
- CVE-2022-44729Apache XML Graphics Batik: Information disclosure vulnerability
- CVE-2022-44730Apache XML Graphics Batik: Information disclosure vulnerability
- CVE-2022-46751Apache Ivy: XML External Entity vulnerability in Apache Ivy
- CVE-2023-40037Apache NiFi: Incomplete Validation of JDBC and JNDI Connection URLs
- CVE-2023-40272Apache Airflow Spark Provider Arbitrary File Read via JDBC
- CVE-2023-39553Apache Airflow Drill Provider Arbitrary File Read Vulnerability
- CVE-2023-33934Apache Traffic Server: Differential fuzzing for HTTP request parsing discrepancies
- CVE-2022-47185Apache Traffic Server: Invalid Range header causes a crash
- CVE-2023-37581Apache Roller: Roller's weblog category, weblog settings and file-upload features did not properly sanitize input could be exploited to perform Reflected Cross Site Scripting (XSS) even on a Roller site configured for untrusted users.
- CVE-2023-39508Apache Airflow: Airflow "Run task" feature allows execution with unnecessary priviledges
- CVE-2023-36542Apache NiFi: Potential Code Injection with Properties Referencing Remote Resources
- CVE-2023-38647Apache Helix: Deserialization vulnerability in Helix workflow and REST
- CVE-2023-38435Apache Felix Healthcheck Webconsole Plugin: XSS in healthcheck webconsole plugin
- CVE-2023-37895Apache Jackrabbit RMI access can lead to RCE
- CVE-2023-35088Apache InLong: SQL injection in audit endpoint
- CVE-2023-34434Apache InLong: JDBC URL bypassing by allowLoadLocalInfileInPath param
- CVE-2023-34189Apache InLong: General user can delete and update process
- CVE-2023-34478Apache Shiro before 1.12.0, or 2.0.0-alpha-3, may be susceptible to a path traversal attack when used together with APIs or other web frameworks that route requests based on non-normalized requests.
- CVE-2023-28754ShardingSphere-Agent: Deserialization vulnerability in ShardingSphere Agent
- CVE-2023-26512Apache EventMesh RabbitMQ-Connector plugin allows RCE through deserialization of untrusted data
- CVE-2023-37415Apache Airflow Apache Hive Provider: Improper Input Validation in Hive Provider with proxy_user
- CVE-2022-45855Apache Ambari: Allows authenticated metrics consumers to perform RCE
- CVE-2022-42009Apache Ambari: A malicious authenticated user can remotely execute arbitrary code in the context of the application.
- CVE-2023-37582Apache RocketMQ: Possible remote code execution when using the update configuration function
- CVE-2023-22888Apache Airflow: Scheduler remote DoS