Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Apache Software Foundation — Vulnerabilities & Security Advisories 1676

Browse all 1676 CVE security advisories affecting Apache Software Foundation. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Top products by Apache Software Foundation:Apache AirflowApache HTTP ServerApache TomcatApache SupersetApache Traffic ServerApache NiFiApache OFBizApache InLongApache DolphinSchedulerApache OpenOfficeApache CloudStackApache StrutsApache SolrApache OpenMeetingsApache ZeppelinApache CamelApache CXFApache HadoopApache GeodeApache FineractApache JSPWikiApache KylinApache PulsarApache DubboApache AmbariApache HiveApache SparkApache ActiveMQApache TikaApache Ranger
CVE IDTitleCVSSSeverityPublished
CVE-2023-25690 Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy — Apache HTTP ServerCWE-444 6.5 -2023-03-07
CVE-2023-25956 Apache Airflow AWS Provider: Arbitrary file read via AWS provider — Apache Airflow AWS ProviderCWE-209 5.3 -2023-02-24
CVE-2023-25696 Apache Airflow Hive Provider Beeline RCE — Apache Airflow Hive ProviderCWE-20 7.5 -2023-02-24
CVE-2023-25693 Sqoop Apache Airflow Provider Remote Code Execution Vulnerability — Apache Airflow Sqoop ProviderCWE-20 9.1 -2023-02-24
CVE-2023-25692 Apache Airflow Google Provider: Google Cloud Sql Provider Denial Of Service — Apache Airflow Google ProviderCWE-20 9.1 -2023-02-24
CVE-2023-25691 Apache Airflow Google Provider: Google Cloud Sql Provider Remote Command Execution — Apache Airflow Google ProviderCWE-20 9.1 -2023-02-24
CVE-2023-25621 Apache Sling does not allow to handle i18n content in a secure way — Apache Sling 6.5 -2023-02-23
CVE-2023-24998 Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts — Apache Commons FileUploadCWE-770 7.5 -2023-02-20
CVE-2023-25613 LDAP Injection Vulnerability in Apache Kerby — Apache Kerby LDAP BackendCWE-74 9.8 -2023-02-20
CVE-2022-42735 Apache ShenYu Admin ultra vires — Apache ShenYuCWE-269 8.8 -2023-02-15
CVE-2023-25141 JNDI injection into Apache sling-org-apache-sling-jcr-base — Apache Sling JCR BaseCWE-74 9.1 -2023-02-14
CVE-2023-22832 Apache NiFi: Improper Restriction of XML External Entity References in ExtractCCDAAttributes — Apache NiFiCWE-611 7.5 -2023-02-10
CVE-2023-25194 Apache Kafka Connect API: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration using Kafka Connect — Apache Kafka Connect APICWE-502 8.8 -2023-02-07
CVE-2022-45786 Apache AGE: Python and Golang drivers allow data manipulation and exposure due to SQL injection — Apache AGECWE-89 7.5 -2023-02-04
CVE-2023-22849 Apache Sling App CMS: XSS in CMS Reference / UI Components — Apache Sling App CMSCWE-79 5.4 -2023-02-04
CVE-2023-24997 Apache InLong: Jdbc Connection Security Bypass — Apache InLongCWE-502 9.8 -2023-02-01
CVE-2023-24977 Apache InLong: Jdbc Connection causes arbitrary file reading in InLong — Apache InLongCWE-125 7.5 -2023-02-01
CVE-2022-28331 Apache Portable Runtime (APR): Windows out-of-bounds write in apr_socket_sendv function — Apache Portable Runtime (APR)CWE-190 9.8 -2023-01-31
CVE-2022-25147 Apache Portable Runtime Utility (APR-util): out-of-bounds writes in the apr_base64 family of functions — Apache Portable Runtime Utility (APR-util)CWE-190 9.8 -2023-01-31
CVE-2022-24963 Apache Portable Runtime (APR): out-of-bound writes in the apr_encode family of functions — Apache Portable Runtime (APR)CWE-190 9.8 -2023-01-31
CVE-2022-44644 Apache Linkis (incubating): The DatasourceManager module has a Local File Read Vulnerability — Apache Linkis (incubating)CWE-20 6.5 -2023-01-31
CVE-2022-44645 Apache Linkis (incubating): The DatasourceManager module has a serialization attack vulnerability — Apache Linkis (incubating)CWE-502 8.8 -2023-01-31
CVE-2023-24829 Apache IoTDB Workbench: apache/iotdb-web-workbench: forge the JWTToken to access workbench — Apache IoTDB WorkbenchCWE-863 8.8 -2023-01-31
CVE-2023-24830 Apache IoTDB Workbench: apache/iotdb-web-workbench: create a user without authorization — Apache IoTDB WorkbenchCWE-287 9.8 -2023-01-30
CVE-2023-22884 Apache Airflow, Apache Airflow MySQL Provider: Arbitrary file read via MySQL provider in Apache Airflow — Apache AirflowCWE-77 9.8 -2023-01-21
CVE-2022-37436 Apache HTTP Server: mod_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting — Apache HTTP ServerCWE-113 7.5 -2023-01-17
CVE-2022-36760 Apache HTTP Server: mod_proxy_ajp Possible request smuggling — Apache HTTP ServerCWE-444 3.7 -2023-01-17
CVE-2006-20001 Apache HTTP Server: mod_dav out of bounds read, or write of zero byte — Apache HTTP ServerCWE-787 7.5 -2023-01-17
CVE-2022-41703 Apache Superset: SQL injection vulnerability in adhoc clauses — Apache Superset 5.4 -2023-01-16
CVE-2022-45438 Apache Superset: Dashboard metadata information leak — Apache SupersetCWE-668 5.3 -2023-01-16

This page lists every published CVE security advisory associated with Apache Software Foundation. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.