Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Apache Software Foundation — Vulnerabilities & Security Advisories 1676

Browse all 1676 CVE security advisories affecting Apache Software Foundation. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Top products by Apache Software Foundation:Apache AirflowApache HTTP ServerApache TomcatApache SupersetApache Traffic ServerApache NiFiApache OFBizApache InLongApache DolphinSchedulerApache OpenOfficeApache CloudStackApache StrutsApache SolrApache OpenMeetingsApache ZeppelinApache CamelApache CXFApache HadoopApache GeodeApache FineractApache JSPWikiApache KylinApache PulsarApache DubboApache AmbariApache HiveApache SparkApache ActiveMQApache TikaApache Ranger
CVE IDTitleCVSSSeverityPublished
CVE-2022-46751 Apache Ivy: XML External Entity vulnerability in Apache Ivy — Apache IvyCWE-611 8.6 -2023-08-21
CVE-2023-40037 Apache NiFi: Incomplete Validation of JDBC and JNDI Connection URLs — Apache NiFiCWE-184 8.1 -2023-08-18
CVE-2023-40272 Apache Airflow Spark Provider Arbitrary File Read via JDBC — Apache Airflow Spark ProviderCWE-20 7.5 -2023-08-17
CVE-2023-39553 Apache Airflow Drill Provider Arbitrary File Read Vulnerability — Apache Airflow Drill ProviderCWE-20 7.5 -2023-08-11
CVE-2023-33934 Apache Traffic Server: Differential fuzzing for HTTP request parsing discrepancies — Apache Traffic ServerCWE-444 8.2 -2023-08-09
CVE-2022-47185 Apache Traffic Server: Invalid Range header causes a crash — Apache Traffic ServerCWE-20 8.2 -2023-08-09
CVE-2023-37581 Apache Roller: Roller's weblog category, weblog settings and file-upload features did not properly sanitize input could be exploited to perform Reflected Cross Site Scripting (XSS) even on a Roller site configured for untrusted users. — Apache RollerCWE-79 5.4 -2023-08-06
CVE-2023-39508 Apache Airflow: Airflow "Run task" feature allows execution with unnecessary priviledges — Apache AirflowCWE-250 8.8 -2023-08-05
CVE-2023-36542 Apache NiFi: Potential Code Injection with Properties Referencing Remote Resources — Apache NiFiCWE-94 8.8 -2023-07-29
CVE-2023-38647 Apache Helix: Deserialization vulnerability in Helix workflow and REST — Apache HelixCWE-502 9.8 -2023-07-26
CVE-2023-38435 Apache Felix Healthcheck Webconsole Plugin: XSS in healthcheck webconsole plugin — Apache Felix Healthcheck Webconsole PluginCWE-79 6.1 -2023-07-25
CVE-2023-37895 Apache Jackrabbit RMI access can lead to RCE — Apache Jackrabbit Webapp (jackrabbit-webapp)CWE-502 9.8 -2023-07-25
CVE-2023-35088 Apache InLong: SQL injection in audit endpoint — Apache InLongCWE-89 9.8 -2023-07-25
CVE-2023-34434 Apache InLong: JDBC URL bypassing by allowLoadLocalInfileInPath param — Apache InLongCWE-502 7.5 -2023-07-25
CVE-2023-34189 Apache InLong: General user can delete and update process — Apache InLongCWE-668 9.1 -2023-07-25
CVE-2023-34478 Apache Shiro before 1.12.0, or 2.0.0-alpha-3, may be susceptible to a path traversal attack when used together with APIs or other web frameworks that route requests based on non-normalized requests. — Apache ShiroCWE-22 9.8 -2023-07-24
CVE-2023-28754 ShardingSphere-Agent: Deserialization vulnerability in ShardingSphere Agent — ShardingSphere-AgentCWE-502 7.8 -2023-07-19
CVE-2023-26512 Apache EventMesh RabbitMQ-Connector plugin allows RCE through deserialization of untrusted data — Apache EventMesh (incubating) RabbitMQ connectorCWE-502 9.8 -2023-07-17
CVE-2023-37415 Apache Airflow Apache Hive Provider: Improper Input Validation in Hive Provider with proxy_user — Apache Airflow Apache Hive ProviderCWE-20 7.1 -2023-07-13
CVE-2022-45855 Apache Ambari: Allows authenticated metrics consumers to perform RCE — Apache AmbariCWE-917 8.0 High2023-07-12
CVE-2022-42009 Apache Ambari: A malicious authenticated user can remotely execute arbitrary code in the context of the application. — Apache AmbariCWE-917 8.0 High2023-07-12
CVE-2023-37582 Apache RocketMQ: Possible remote code execution when using the update configuration function — Apache RocketMQCWE-94 9.8 -2023-07-12
CVE-2023-22888 Apache Airflow: Scheduler remote DoS — Apache AirflowCWE-20 6.5 -2023-07-12
CVE-2023-36543 Apache Airflow: ReDoS via dags function — Apache AirflowCWE-1333 6.5 -2023-07-12
CVE-2022-46651 Apache Airflow: Security vulnerability on AirFlow Connections — Apache AirflowCWE-200 6.5 -2023-07-12
CVE-2023-22887 Apache Airflow path traversal by authenticated user — Apache AirflowCWE-22 6.5 -2023-07-12
CVE-2023-35908 Apache Airflow: Access to DAGs without relevant permission — Apache AirflowCWE-863 5.3 -2023-07-12
CVE-2023-30428 Apache Pulsar Broker: Incorrect Authorization Validation for Rest Producer — Apache Pulsar BrokerCWE-863 8.2 High2023-07-12
CVE-2023-30429 Apache Pulsar: Incorrect Authorization for Function Worker when using mTLS Authentication through Pulsar Proxy — Apache PulsarCWE-863 9.6 Critical2023-07-12
CVE-2023-31007 Apache Pulsar: Broker does not always disconnect client when authentication data expires — Apache PulsarCWE-287--2023-07-12

This page lists every published CVE security advisory associated with Apache Software Foundation. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.