Apache CVEs
3,093 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2018-11797In Apache PDFBox 1.8.0 to 1.8.15 and 2.0.0RC1 to 2.0.11, a carefully crafted PDF file can trigger an extremely long running computation when
- CVE-2018-11778UnixAuthenticationService in Apache Ranger 1.2.0 was updated to correctly handle user input to avoid Stack-based buffer overflow.
- CVE-2017-5658The statistics generator in Apache Pony Mail 0.7 to 0.9 was found to be returning timestamp data without proper authorization checks.
- CVE-2018-11784When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directo
- CVE-2018-11763In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU
- CVE-2018-8023Apache Mesos can be configured to require authentication to call the Executor HTTP API using JSON Web Token (JWT).
- CVE-2018-8017In Apache Tika 1.2 to 1.18, a carefully crafted file can trigger an infinite loop in the IptcAnpaParser.
- CVE-2018-11762In Apache Tika 0.9 to 1.18, in a rare edge case where a user does not specify an extract directory on the commandline (--extract-dir=) and t
- CVE-2018-11761In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion.
- CVE-2018-11787In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Karaf, it is available at .../system/conso
- CVE-2018-11786In Apache Karaf prior to 4.2.0 release, if the sshd service in Karaf is left on so an administrator can manage the running instance, any use
- CVE-2018-8041Apache Camel's Mail 2.20.0 through 2.20.3, 2.21.0 through 2.21.1 and 2.22.0 is vulnerable to path traversal.
- CVE-2018-11781Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax.
- CVE-2018-11780A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2.
- CVE-2017-15705A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2.
- CVE-2018-1330When parsing a malformed JSON payload, libprocess in Apache Mesos versions 1.4.0 to 1.5.0 might crash due to an uncaught exception.
- CVE-2018-11775TLS hostname verification when using the Apache ActiveMQ Client before 5.15.6 was missing which could make the client vulnerable to a MITM a
- CVE-2018-8040Pages that are rendered using the ESI plugin can have access to the cookie header when the plugin is configured not to allow access.
- CVE-2018-8022A carefully crafted invalid TLS handshake can cause Apache Traffic Server (ATS) to segfault.
- CVE-2018-8005When there are multiple ranges in a range request, Apache Traffic Server (ATS) will read the entire object from cache.
- CVE-2018-8004There are multiple HTTP smuggling and cache poisoning issues when clients making malicious requests interact with Apache Traffic Server (ATS
- CVE-2018-1318Adding method ACLs in remap.config can cause a segfault when the user makes a carefully crafted request.
- CVE-2018-8028An authenticated user can execute ALTER TABLE EXCHANGE PARTITIONS without being authorized by Apache Sentry before 2.0.1.
- CVE-2018-11758This affects Apache Cayenne 4.1.M1, 3.2.M1, 4.0.M2 to 4.0.M5, 4.0.B1, 4.0.B2, 4.0.RC1, 3.1, 3.1.1, 3.1.2.
- CVE-2018-11776Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (ei
- CVE-2018-11771When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to ret
- CVE-2016-4975mod_userdir CRLF injection
- CVE-2018-11770From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism u
- CVE-2018-11769CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S).
- CVE-2017-12614It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack.