Apache CVEs
3,093 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2023-36543Apache Airflow: ReDoS via dags function
- CVE-2022-46651Apache Airflow: Security vulnerability on AirFlow Connections
- CVE-2023-22887Apache Airflow path traversal by authenticated user
- CVE-2023-35908Apache Airflow: Access to DAGs without relevant permission
- CVE-2023-30428Apache Pulsar Broker: Incorrect Authorization Validation for Rest Producer
- CVE-2023-30429Apache Pulsar: Incorrect Authorization for Function Worker when using mTLS Authentication through Pulsar Proxy
- CVE-2023-31007Apache Pulsar: Broker does not always disconnect client when authentication data expires
- CVE-2023-37579Apache Pulsar Function Worker: Incorrect Authorization for Function Worker Can Leak Sink/Source Credentials
- CVE-2023-32200Apache Jena: Exposure of execution in script engine expressions.
- CVE-2023-34442Apache Camel JIRA: Temporary file information disclosure in Camel-Jira
- CVE-2023-35887Apache MINA SSHD: Information disclosure bugs with RootedFilesystem
- CVE-2023-33008Apache Johnzon: Prevent inefficient internal conversion from BigDecimal at large scale
- CVE-2023-34150Apache Any23: Possible excessive allocation of resources reading input.
- CVE-2023-35797Apache Airflow Hive Provider Beeline RCE with Principal
- CVE-2023-22886Apache Airflow JDBC Provider: RCE Vulnerability
- CVE-2023-35798Airflow Apache ODBC and MSSQL Providers Arbitrary File Read Vulnerability
- CVE-2023-34395Apache Airflow ODBC Provider: Remote code execution vulnerability
- CVE-2023-31469Apache StreamPipes: Privilege escalation through non-admin user
- CVE-2023-34981Apache Tomcat: AJP response header mix-up
- CVE-2023-34340Apache Accumulo: Accumulo 2.1.0 may incorrectly validate cached credentials
- CVE-2023-35005Apache Airflow: Information disclosure on configuration view
- CVE-2023-34396Apache Struts: DoS via OOM owing to no sanity limit on normal form fields in multipart forms
- CVE-2023-34149Apache Struts: DoS via OOM owing to not properly checking of list bounds
- CVE-2023-30631Apache Traffic Server: Configuration option to block the PUSH method in ATS didn't work
- CVE-2023-33933Apache Traffic Server: s3_auth plugin problem with hash calculation
- CVE-2022-47184Apache Traffic Server: The TRACE method can be use to disclose network information
- CVE-2023-34212Apache NiFi: Potential Deserialization of Untrusted Data with JNDI in JMS Components
- CVE-2023-34468Apache NiFi: Potential Code Injection with Database Services using H2
- CVE-2023-30576Apache Guacamole: Use-after-free in handling of RDP audio input buffer
- CVE-2023-30575Apache Guacamole: Incorrect calculation of Guacamole protocol element lengths