Apache CVEs
3,093 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2022-43670XSS in Sling CMS Reference App Taxonomy Path
- CVE-2022-42252Apache Tomcat request smuggling via malformed content-length
- CVE-2022-34662Apache DolphinScheduler prior to 3.0.0 allows path traversal
- CVE-2022-31777Apache Spark XSS vulnerability in log viewer UI Javascript
- CVE-2022-26884Apache DolphinScheduler exposes files without authentication
- CVE-2022-43766Apache IoTDB prior to 0.13.3 allows DoS
- CVE-2022-42468Apache Flume prior to 1.11.0 has an Improper Input Validation (JNDI Injection) in JMSSource
- CVE-2022-39944The Apache Linkis JDBC EngineConn module has a RCE Vulnerability
- CVE-2022-42890Apache Batik prior to 1.16 allows RCE via scripting
- CVE-2022-41704Apache Batik prior to 1.16 allows RCE when loading untrusted SVG input
- CVE-2022-34870Apache Geode stored Cross-Site Scripting (XSS) via data injection vulnerability in Pulse web application
- CVE-2021-42010CRLF log injection
- CVE-2022-42467h2 webconsole (available only in prototype mode) should nevertheless be disabled by default.
- CVE-2022-42466XSS vulnerability, eg for String properties.
- CVE-2022-39198Apache Dubbo Hession Deserialization Vulnerability Gadgets Bypass
- CVE-2022-42889Apache Commons Text prior to 1.10.0 allows RCE when applied to untrusted input due to insecure interpolation defaults
- CVE-2022-24697Apache Kylin prior to 4.0.2 allows command injection when the configuration overwrites function overwrites system parameters
- CVE-2022-40664Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher
- CVE-2022-41672Session still functional after user is deactivated
- CVE-2021-43980Apache Tomcat: Information disclosure
- CVE-2022-33683Disabled Certificate Validation makes Broker, Proxy Admin Clients vulnerable to MITM attack
- CVE-2022-33682Disabled Hostname Verification makes Brokers, Proxies vulnerable to MITM attack
- CVE-2022-33681Improper Hostname Verification in Java Client and Proxy can expose authentication data via MITM
- CVE-2022-24280Apache Pulsar Proxy target broker address isn't validated
- CVE-2022-26112Pinot query endpoint and the realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support
- CVE-2022-40705Apache SOAP: XML External Entity Injection (XXE) allows unauthenticated users to read arbitrary files via HTTP
- CVE-2022-40146Jar url should be blocked by DefaultScriptSecurity
- CVE-2022-38648PDFTranscoder does not block external resources
- CVE-2022-38398Server-Side Request Forgery Information Disclosure Vulnerability
- CVE-2022-40754Open Redirect