Filtered by vendor Apache
Subscriptions
Total
2321 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2019-0231 | 2 Apache, Redhat | 6 Mina, Jboss Enterprise Bpms Platform, Jboss Enterprise Brms Platform and 3 more | 2024-09-17 | 7.5 High |
| Handling of the close_notify SSL/TLS message does not lead to a connection closure, leading the server to retain the socket opened and to have the client potentially receive clear text messages afterward. Mitigation: 2.0.20 users should migrate to 2.0.21, 2.1.0 users should migrate to 2.1.1. This issue affects: Apache MINA. | ||||
| CVE-2017-7663 | 1 Apache | 1 Openmeetings | 2024-09-17 | N/A |
| Both global and Room chat are vulnerable to XSS attack in Apache OpenMeetings 3.2.0. | ||||
| CVE-2018-1316 | 1 Apache | 1 Ode | 2024-09-17 | N/A |
| The ODE process deployment web service was sensible to deployment messages with forged names. Using a path for the name was allowing directory traversal, resulting in the potential writing of files under unwanted locations, the overwriting of existing files or their deletion. This issue was addressed in Apache ODE 1.3.3 which was released in 2009, however the incorrect name CVE-2008-2370 was used on the advisory by mistake. | ||||
| CVE-2004-2650 | 1 Apache | 1 James | 2024-09-17 | N/A |
| Spooler in Apache Foundation James 2.2.0 allows local users to cause a denial of service (memory consumption) by triggering various error conditions in the retrieve function, which prevents a lock from being released and causes a memory leak. | ||||
| CVE-2017-7688 | 1 Apache | 1 Openmeetings | 2024-09-17 | N/A |
| Apache OpenMeetings 1.0.0 updates user password in insecure manner. | ||||
| CVE-2017-9794 | 1 Apache | 1 Geode | 2024-09-17 | N/A |
| When a cluster is operating in secure mode, a user with read privileges for specific data regions can use the gfsh command line utility to execute queries. In Apache Geode before 1.2.1, the query results may contain data from another user's concurrently executing gfsh query, potentially revealing data that the user is not authorized to view. | ||||
| CVE-2018-1287 | 1 Apache | 1 Jmeter | 2024-09-17 | N/A |
| In Apache JMeter 2.X and 3.X, when using Distributed Test only (RMI based), jmeter server binds RMI Registry to wildcard host. This could allow an attacker to get Access to JMeterEngine and send unauthorized code. | ||||
| CVE-2017-15718 | 1 Apache | 1 Hadoop | 2024-09-17 | N/A |
| The YARN NodeManager in Apache Hadoop 2.7.3 and 2.7.4 can leak the password for credential store provider used by the NodeManager to YARN Applications. | ||||
| CVE-2012-4458 | 2 Apache, Redhat | 2 Qpid, Enterprise Mrg | 2024-09-17 | N/A |
| The AMQP type decoder in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service (memory consumption and server crash) via a large number of zero width elements in the client-properties map in a connection.start-ok message. | ||||
| CVE-2018-17184 | 1 Apache | 1 Syncope | 2024-09-17 | N/A |
| A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector names, Report names, AnyTypeClass keys and Policy descriptions. When another user with enough administration entitlements edits one of the Entities above via Admin Console, the injected JavaScript code is executed. | ||||
| CVE-2018-1288 | 3 Apache, Oracle, Redhat | 6 Kafka, Database, Primavera P6 Enterprise Project Portfolio Management and 3 more | 2024-09-17 | 5.4 Medium |
| In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss. | ||||
| CVE-2017-15708 | 2 Apache, Oracle | 3 Synapse, Financial Services Market Risk Measurement And Management, Peoplesoft Enterprise Peopletools | 2024-09-17 | 9.8 Critical |
| In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). So Apache Synapse 3.0.1 or all previous releases (3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1) allows remote code execution attacks that can be performed by injecting specially crafted serialized objects. And the presence of Apache Commons Collections 3.2.1 (commons-collections-3.2.1.jar) or previous versions in Synapse distribution makes this exploitable. To mitigate the issue, we need to limit RMI access to trusted users only. Further upgrading to 3.0.1 version will eliminate the risk of having said Commons Collection version. In Synapse 3.0.1, Commons Collection has been updated to 3.2.2 version. | ||||
| CVE-2017-9787 | 1 Apache | 1 Struts | 2024-09-17 | N/A |
| When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack. Solution is to upgrade to Apache Struts version 2.5.12 or 2.3.33. | ||||
| CVE-2018-1308 | 2 Apache, Debian | 2 Solr, Debian Linux | 2024-09-17 | N/A |
| This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in the `&dataConfig=<inlinexml>` parameter of Solr's DataImportHandler. It can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the internal network. | ||||
| CVE-2018-1302 | 4 Apache, Canonical, Netapp and 1 more | 7 Http Server, Ubuntu Linux, Clustered Data Ontap and 4 more | 2024-09-17 | N/A |
| When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have written a NULL pointer potentially to an already freed memory. The memory pools maintained by the server make this vulnerability hard to trigger in usual configurations, the reporter and the team could not reproduce it outside debug builds, so it is classified as low risk. | ||||
| CVE-2010-2086 | 2 Apache, Redhat | 2 Myfaces, Jboss Enterprise Web Server | 2024-09-17 | N/A |
| Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object. | ||||
| CVE-2013-7372 | 2 Apache, Google | 2 Harmony, Android | 2024-09-17 | N/A |
| The engineNextBytes function in classlib/modules/security/src/main/java/common/org/apache/harmony/security/provider/crypto/SHA1PRNG_SecureRandomImpl.java in the SecureRandom implementation in Apache Harmony through 6.0M3, as used in the Java Cryptography Architecture (JCA) in Android before 4.4 and other products, when no seed is provided by the user, uses an incorrect offset value, which makes it easier for attackers to defeat cryptographic protection mechanisms by leveraging the resulting PRNG predictability, as exploited in the wild against Bitcoin wallet applications in August 2013. | ||||
| CVE-2016-6795 | 1 Apache | 1 Struts | 2024-09-17 | N/A |
| In the Convention plugin in Apache Struts 2.3.x before 2.3.31, and 2.5.x before 2.5.5, it is possible to prepare a special URL which will be used for path traversal and execution of arbitrary code on server side. | ||||
| CVE-2017-17836 | 1 Apache | 1 Airflow | 2024-09-17 | N/A |
| In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases used by Airflow. An attacker who has limited access to airflow, whether it be via XSS or by leaving a machine unlocked can exfiltrate all credentials from the system. | ||||
| CVE-2018-8017 | 1 Apache | 1 Tika | 2024-09-17 | N/A |
| In Apache Tika 1.2 to 1.18, a carefully crafted file can trigger an infinite loop in the IptcAnpaParser. | ||||