Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

CVE-2022-23437

Infinite loop within Apache XercesJ xml parser

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.

CVSS 3.1 · 6.5 Medium EPSS 11.6% KEV · Not listed
Vendors
Apache Netapp Oracle and 1 more
Products
Xerces-j Active Iq Unified Manager Agile Engineering Data Management and 28 more
CVE-2021-45105

Apache Log4j2 does not always protect from infinite recursion in lookup evaluation

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.

CVSS 3.1 · 5.9 Medium EPSS 100.0% KEV · Not listed
Vendors
Apache Debian Netapp and 3 more
Products
Log4j Debian Linux Cloud Manager and 128 more
CVE-2019-0227

axis: Hard coded domain name in example web service named “StockQuoteService.jws” leading to remote code execution.

A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.

CVSS 3.1 · 7.5 High EPSS 91.9% KEV · Not listed
Vendors
Apache Oracle
Products
Axis Agile Engineering Data Management Agile Product Lifecycle Management and 34 more
CVE-2020-1945

ant: insecure temporary file vulnerability

Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process.

CVSS 3.1 · 6.3 Medium EPSS 1.8% KEV · Not listed
Vendors
Apache Canonical Fedoraproject and 3 more
Products
Ant Ubuntu Linux Fedora and 51 more