Apache CVEs
3,093 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2020-17531Deserialization flaw in EOL Tapestry 4.
- CVE-2020-17521Apache Groovy provides extension methods to aid with creating temporary directories.
- CVE-2020-13945In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules.
- CVE-2020-17527Apache Tomcat: Request header mix-up between HTTP/2 streams
- CVE-2020-13942Remote Code Execution in Apache Unomi
- CVE-2020-13954Apache CXF Reflected XSS in the services listing page via the styleSheetPath
- CVE-2020-9485An issue was found in Apache Airflow versions 1.10.10 and below.
- CVE-2020-11983An issue was found in Apache Airflow versions 1.10.10 and below.
- CVE-2020-11982An issue was found in Apache Airflow versions 1.10.10 and below.
- CVE-2020-11981An issue was found in Apache Airflow versions 1.10.10 and below.
- CVE-2020-11978An issue was found in Apache Airflow versions 1.10.10 and below.
- CVE-2020-11996A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could t
- CVE-2020-9494Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.10, and 8.0.0 to 8.0.7 is vulnerable to certain types of HTTP/2 HEADERS frames that can c
- CVE-2020-9480In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) v
- CVE-2020-11989Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication
- CVE-2020-1956Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a
- CVE-2019-0235Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks.
- CVE-2019-12425Apache OFBiz 17.12.01 is vulnerable to Host header injection by accepting arbitrary host
- CVE-2020-9482If NiFi Registry 0.1.0 to 0.5.0 uses an authentication mechanism other than PKI, when the user clicks Log Out, NiFi Registry invalidates the
- CVE-2020-9481Apache ATS 6.0.0 to 6.2.3, 7.0.0 to 7.1.9, and 8.0.0 to 8.0.6 is vulnerable to a HTTP/2 slow read attack.
- CVE-2020-1952An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2.
- CVE-2020-9488Improper validation of certificate with host mismatch in Apache Log4j SMTP appender.
- CVE-2020-9489A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser.
- CVE-2020-1927In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by en
- CVE-2020-1958When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the creden
- CVE-2019-17564Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled.
- CVE-2018-11802In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection.
- CVE-2020-1954Apache CXF has the ability to integrate with JMX by registering an InstrumentationManager extension with the CXF bus.
- CVE-2020-1934In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server.
- CVE-2020-1943Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07.