Apache CVEs
3,093 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2021-37150Protocol vs scheme mismatch
- CVE-2022-36125Integer overflow when reading corrupted .avro file in Avro Rust SDK
- CVE-2022-36124Memory overconsumption in Avro Rust SDK
- CVE-2022-35724Denial of service while reading data in Avro Rust SDK
- CVE-2022-25168Command injection in org.apache.hadoop.fs.FileUtil.unTarUsingTar
- CVE-2022-34158User Group Privilege Escalation
- CVE-2022-28732Apache JSPWiki Cross-site scripting vulnerability on WeblogPlugin
- CVE-2022-28731Apache JSPWiki CSRF in UserPreferences.jsp
- CVE-2022-28730Apache JSPWiki Cross-site scripting vulnerability on AJAXPreview.jsp
- CVE-2022-27166XSS vulnerability on XHRHtml2Markup.jsp in JSPWiki 2.11.2
- CVE-2022-36364Apache Calcite Avatica JDBC driver `httpclient_impl` connection property can be used as an RCE vector
- CVE-2022-24294ReDoS in Apache MXNet RTC Module
- CVE-2022-34169Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets
- CVE-2022-35741Apache CloudStack SAML Single Sign-On XXE
- CVE-2022-36127Service unavailability impact in NodeJS agent(version <= 0.5.0)
- CVE-2022-33891Apache Spark shell command injection vulnerability via Spark UI
- CVE-2021-34538Apache Hive Security vulnerability in Hive with UDFs
- CVE-2022-31781Regular Expression Denial of Service (ReDoS) in ContentType.java. (GHSL-2022-022)
- CVE-2022-28889Clickjacking in the web console
- CVE-2021-44791Reflected XSS on certain HTTP endpoints
- CVE-2021-37839Improper access to dataset metadata information
- CVE-2022-32533Apache Portals Jetspeed XSS, CSRF, SSRF, and XXE issues
- CVE-2022-33980Apache Commons Configuration insecure interpolation defaults
- CVE-2022-32532Authentication Bypass Vulnerability
- CVE-2022-33879Incomplete fix and new regex DoS in StandardsExtractingContentHandler
- CVE-2022-26477Denial of service in readExternal method
- CVE-2022-34305XSS in examples web application
- CVE-2022-32549log injection in Sling logging
- CVE-2022-33140Improper Neutralization of Command Elements in Shell User Group Provider
- CVE-2021-33036Apache Hadoop Privilege escalation vulnerability