Apache vulnerabilities
3,470 vulnerabilities
Known vulnerabilities in Apache products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 431 products.
Products
50 of 431- Http Server350 vulnerabilities
- Tomcat274 vulnerabilities
- Airflow158 vulnerabilities
- Traffic Server120 vulnerabilities
- Struts99 vulnerabilities
- Camel86 vulnerabilities
- Activemq75 vulnerabilities
- Cxf74 vulnerabilities
- Ofbiz73 vulnerabilities
- Superset70 vulnerabilities
- Cloudstack65 vulnerabilities
- Openoffice60 vulnerabilities
- Nifi59 vulnerabilities
- Solr47 vulnerabilities
- Subversion47 vulnerabilities
- Inlong42 vulnerabilities
- Hadoop37 vulnerabilities
- Dolphinscheduler34 vulnerabilities
- Wicket33 vulnerabilities
- Thrift32 vulnerabilities
- Ranger31 vulnerabilities
- Apisix29 vulnerabilities
- Jspwiki29 vulnerabilities
- Openmeetings29 vulnerabilities
- Tika27 vulnerabilities
- Ambari26 vulnerabilities
- Zeppelin26 vulnerabilities
- Shiro25 vulnerabilities
- Answer24 vulnerabilities
- Kylin24 vulnerabilities
- Syncope24 vulnerabilities
- Fineract23 vulnerabilities
- Geode23 vulnerabilities
- Hive23 vulnerabilities
- Artemis22 vulnerabilities
- Spark22 vulnerabilities
- Qpid Broker J21 vulnerabilities
- Archiva20 vulnerabilities
- Couchdb20 vulnerabilities
- Iotdb20 vulnerabilities
- Log4J20 vulnerabilities
- Pulsar20 vulnerabilities
- Cordova19 vulnerabilities
- Dubbo19 vulnerabilities
- Karaf18 vulnerabilities
- Linkis18 vulnerabilities
- Kafka17 vulnerabilities
- Streampark17 vulnerabilities
- Cassandra16 vulnerabilities
- Hertzbeat16 vulnerabilities
CVE-2018-21234apachehive+3
EPSS score8.32%
Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set.CVE-2018-2799apachexerces-j+37EPSS score14.77%
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAXP). Supported versions that are affected are Java SE: 7u171, 8u162 and 10; Java SE Embedded: 8u161; JRockit: R28.3.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: Applies to client and server deployment of Java. This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).CVE-2018-1322apache software foundationapache syncope+2EPSS score19.92%
An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters.CVE-2018-1327apache software foundationapache struts+2EPSS score8.65%
The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version 2.5.16 and switch to an optional Jackson XML handler as described here http://struts.apache.org/plugins/rest/#custom-contenttypehandlers. Another option is to implement a custom XML handler based on the Jackson XML handler from the Apache Struts 2.5.16.CVE-2018-1313apache software foundationapache derby+5EPSS score4.59%
In Apache Derby 10.3.1.4 to 10.14.1.0, a specially-crafted network packet can be used to request the Derby Network Server to boot a database whose location and contents are under the user's control. If the Derby Network Server is not running with a Java Security Manager policy file, the attack is successful. If the server is using a policy file, the policy file must permit the database location to be read for the attack to work. The default Derby Network Server policy file distributed with the affected releases includes a permissive policy as the default Network Server policy, which allows the attack to work.CVE-2018-1319apache software foundationapache allura+1EPSS score2.16%
In Apache Allura prior to 1.8.1, attackers may craft URLs that cause HTTP response splitting. If a victim goes to a maliciously crafted URL, unwanted results may occur including XSS or service denial for the victim's browsing session.CVE-2018-1292apache software foundationapache fineract+1EPSS score2.04%
Within the 'getReportType' method in Apache Fineract 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating, a hacker could inject SQL to read/update data for which he doesn't have authorization for by way of the 'reportName' parameter.CVE-2018-1323apache software foundationapache tomcat connectors+1EPSS score46.40%
The IIS/ISAPI specific code in the Apache Tomcat JK ISAPI Connector 1.2.0 to 1.2.42 that normalised the requested path before matching it to the URI-worker map did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via IIS, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing Tomcat via the reverse proxy.CVE-2018-1336apache software foundationapache tomcat+68EPSS score20.35%
An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.CVE-2018-1315apache software foundationapache hive+4EPSS score1.75%
In Apache Hive 2.1.0 to 2.3.2, when 'COPY FROM FTP' statement is run using HPL/SQL extension to Hive, a compromised/malicious FTP server can cause the file to be written to an arbitrary location on the cluster where the command is run from. This is because FTP client code in HPL/SQL does not verify the destination location of the downloaded file. This does not affect hive cli user and hiveserver2 user as hplsql is a separate command line script and needs to be invoked differently.CVE-2018-1286apache software foundationapache openmeetings+2EPSS score1.08%
In Apache OpenMeetings 3.0.0 - 4.0.1, CRUD operations on privileged users are not password protected allowing an authenticated attacker to deny service for privileged users.CVE-2018-1287apache software foundationapache jmeter+4EPSS score3.35%
In Apache JMeter 2.X and 3.X, when using Distributed Test only (RMI based), jmeter server binds RMI Registry to wildcard host. This could allow an attacker to get Access to JMeterEngine and send unauthorized code.CVE-2018-1291apache software foundationapache fineract+1EPSS score2.00%
Apache Fineract 1.0.0, 0.6.0-incubating, 0.5.0-incubating, 0.4.0-incubating exposes different REST end points to query domain specific entities with a Query Parameter 'orderBy' which are appended directly with SQL statements. A hacker/user can inject/draft the 'orderBy' query parameter by way of the "order" param in such a way to read/update the data for which he doesn't have authorization.CVE-2018-1337apache software foundationapache directory+3EPSS score5.15%
In Apache Directory LDAP API before 1.0.2, a bug in the way the SSL Filter was setup made it possible for another thread to use the connection before the TLS layer has been established, if the connection has already been used and put back in a pool of connections, leading to leaking any information contained in this request (including the credentials when sending a BIND request).CVE-2018-1334apache software foundationapache spark+4EPSS score0.51%
In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application.CVE-2018-1298apache software foundationapache qpid broker-j+2EPSS score2.33%
A Denial of Service vulnerability was found in Apache Qpid Broker-J 7.0.0 in functionality for authentication of connections for AMQP protocols 0-8, 0-9, 0-91 and 0-10 when PLAIN or XOAUTH2 SASL mechanism is used. The vulnerability allows unauthenticated attacker to crash the broker instance. AMQP 1.0 and HTTP connections are not affected. An authentication of incoming AMQP connections in Apache Qpid Broker-J is performed by special entities called "Authentication Providers". Each Authentication Provider can support several SASL mechanisms which are offered to the connecting clients as part of SASL negotiation process. The client chooses the most appropriate SASL mechanism for authentication. Authentication Providers of following types supports PLAIN SASL mechanism: Plain, PlainPasswordFile, SimpleLDAP, Base64MD5PasswordFile, MD5, SCRAM-SHA-256, SCRAM-SHA-1. XOAUTH2 SASL mechanism is supported by Authentication Providers of type OAuth2. If an AMQP port is configured with any of these Authentication Providers, the Broker may be vulnerable.CVE-2018-1295apache software foundationapache ignite+2EPSS score6.35%
In Apache Ignite 2.3 or earlier, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one sends a specially prepared form of a serialized object to one of the deserialization endpoints of some Ignite components - discovery SPI, Ignite persistence, Memcached endpoint, socket steamer.CVE-2018-1302apache software foundationapache http server+9EPSS score12.88%
When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerability hard to trigger in usual configurations, the reporter and the team could not reproduce it outside debug builds, so it is classified as low risk.CVE-2018-1333apache software foundationapache http server+11EPSS score17.10%
By specially crafting HTTP/2 requests, workers would be allocated 60 seconds longer than necessary, leading to worker exhaustion and a denial of service. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.18-2.4.30,2.4.33).CVE-2018-1330apache software foundationapache mesos+4EPSS score3.74%
When parsing a malformed JSON payload, libprocess in Apache Mesos versions 1.4.0 to 1.5.0 might crash due to an uncaught exception. Parsing chunked HTTP requests with trailers can lead to a libprocess crash too because of the mistakenly planted assertion. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.