Apache CVEs
3,093 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2021-45232security vulnerability on unauthorized access.
- CVE-2021-44548Apache Solr information disclosure vulnerability through DataImportHandler
- CVE-2021-44224Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier
- CVE-2021-41561Apache Parquet-MR potential DoS in case of malicious Parquet file
- CVE-2021-44790Possible buffer overflow when parsing multipart content in mod_lua of Apache HTTP Server 2.4.51 and earlier
- CVE-2021-43083Apache PLC4X 0.9.0 Buffer overflow in PLC4C via crafted server response
- CVE-2021-45105Apache Log4j2 does not always protect from infinite recursion in lookup evaluation
- CVE-2021-44145Apache NiFi information disclosure by XXE
- CVE-2021-45046Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack
- CVE-2021-44549SMTPS server hostname not checked when making TLS connection to SMTPS server
- CVE-2021-4104Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2
- CVE-2021-44228Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
- CVE-2021-43410airavata-django-portal allows CRLF log injection because of the lack of escaping in the log statements
- CVE-2021-44140Arbitrary file deletion on logout
- CVE-2021-40369XSS vulnerability on Denounce plugin
- CVE-2021-43557Path traversal in request_uri variable
- CVE-2021-41532Unauthenticated access to Ozone Recon HTTP endpoints
- CVE-2021-39236Owners of the S3 tokens are not validated
- CVE-2021-39235Access mode of block tokens are not enforced
- CVE-2021-39234Raw block data can be read bypassing ACL/authorization
- CVE-2021-39233Container-related datanode operations can be called without authorization
- CVE-2021-39232Missing admin check for SCM related admin commands
- CVE-2021-39231Missing authentication/authorization on internal RPC endpoints
- CVE-2021-36372Original block tokens are persisted and can be retrieved
- CVE-2021-42250Possible log injection
- CVE-2021-37580Apache ShenYu Admin bypass JWT authentication
- CVE-2021-41972Credentials leak
- CVE-2021-43350LDAP filter injection vulnerability in Traffic Ops
- CVE-2021-26558Deserialization of Untrusted Data
- CVE-2021-43082heap-buffer-overflow with stats-over-http plugin