Apache CVEs
3,093 CVEs and advisories name Apache as an affected vendor, 33 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2016-8742The Windows installer that the Apache CouchDB team provides was vulnerable to local privilege escalation.
- CVE-2016-5397The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting t
- CVE-2018-1307In Apache jUDDI 3.2 through 3.3.4, if using the WADL2Java or WSDL2Java classes, which parse a local or remote XML document and then mediates
- CVE-2018-1298A Denial of Service vulnerability was found in Apache Qpid Broker-J 7.0.0 in functionality for authentication of connections for AMQP protoc
- CVE-2018-1299In Apache Allura before 1.8.0, unauthenticated attackers may retrieve arbitrary files through the Allura web application.
- CVE-2016-6813Apache CloudStack 4.1 to 4.8.1.0 and 4.9.0.0 contain an API call designed to allow a user to register for the developer API.
- CVE-2013-4317In Apache CloudStack 4.1.0 and 4.1.1, when calling the CloudStack API call listProjectAccounts as a regular, non-administrative user, the us
- CVE-2017-3160After the Android platform is added to Cordova the first time, or after a project is created using the build scripts, the scripts will fetch
- CVE-2017-15706As part of the fix for bug 61201, the documentation for Apache Tomcat 9.0.0.M22 to 9.0.1, 8.5.16 to 8.5.23, 8.0.45 to 8.0.47 and 7.0.79 to 7
- CVE-2017-15698When parsing the AIA-Extension field of a client certificate, Apache Tomcat Native Connector 1.2.0 to 1.2.14 and 1.1.23 to 1.1.34 did not co
- CVE-2017-12626Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF,
- CVE-2017-15703Any authenticated user (valid client certificate but without ACL permissions) could upload a template which contained malicious code and cau
- CVE-2017-15718The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Ap
- CVE-2017-15697A malicious X-ProxyContextPath or X-Forwarded-Context header containing external resources or embedded code could cause remote code executio
- CVE-2017-12632A malicious host header in an incoming HTTP request could cause NiFi to load resources from an external server.
- CVE-2017-15713Vulnerability in Apache Hadoop 0.23.x, 2.x before 2.7.5, 2.8.x before 2.8.3, and 3.0.0-alpha through 3.0.0-beta1 allows a cluster user to ex
- CVE-2017-3158A race condition in Guacamole's terminal emulator in versions 0.9.5 through 0.9.10-incubating could allow writes of blocks of printed data t
- CVE-2016-6810In Apache ActiveMQ 5.x before 5.14.2, an instance of a cross-site scripting vulnerability was identified to be present in the web based admi
- CVE-2017-15717A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and org.apache.sling.xss.impl.XSSFil
- CVE-2017-9796When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster m
- CVE-2017-9795When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster m
- CVE-2017-12622When an Apache Geode cluster before v1.3.0 is operating in secure mode and an authenticated user connects to a Geode cluster using the gfsh
- CVE-2012-3353The Apache Sling JCR ContentLoader 2.1.4 XmlReader used in the Sling JCR content loader module makes it possible to import arbitrary files i
- CVE-2017-17837The Apache DeltaSpike-JSF 1.8.0 module has a XSS injection leak in the windowId handling.
- CVE-2017-15714The BIRT plugin in Apache OFBiz 16.11.01 to 16.11.03 does not escape user input property passed.
- CVE-2017-5641Previous versions of Apache Flex BlazeDS (4.7.2 and earlier) did not restrict which types were allowed for AMF(X) object deserialization by
- CVE-2017-15700A flaw in the org.apache.sling.auth.core.AuthUtil#isRedirectValid method in Apache Sling Authentication Service 1.4.0 allows an attacker, th
- CVE-2017-12630In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effe
- CVE-2017-5663In Apache Fineract 0.4.0-incubating, 0.5.0-incubating, and 0.6.0-incubating, an authenticated user with client/loan/center/staff/group read
- CVE-2017-15708In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI).