Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

Apache Software Foundation — Vulnerabilities & Security Advisories 2370

Browse all 2370 CVE security advisories affecting Apache Software Foundation. AI-powered Chinese analysis, POCs, and references for each vulnerability.

The Apache Software Foundation develops and maintains open-source software, primarily known for the widely deployed Apache HTTP Server and foundational Java frameworks. Its extensive portfolio exposes a significant attack surface, evidenced by the 1717 recorded CVEs. Historically, vulnerabilities frequently involve remote code execution, cross-site scripting, and privilege escalation, often stemming from complex configuration errors or input validation failures in legacy components. While the foundation enforces rigorous security review processes, the sheer volume of projects increases the likelihood of undiscovered flaws. Notable incidents include critical flaws in Log4j, which allowed remote code execution via crafted log messages, highlighting risks in dependency management. The organization relies on community-driven patching, requiring administrators to promptly apply updates to mitigate exploitation. This model ensures transparency but demands active vigilance from users to maintain system integrity against evolving threat vectors.

Top products by Apache Software Foundation: Apache Airflow Apache Tomcat Apache HTTP Server Apache Traffic Server Apache Superset Apache OFBiz Apache CloudStack Apache Camel Apache NiFi Apache CXF Apache InLong Apache Syncope Apache DolphinScheduler Apache Struts Apache Thrift Apache APISIX Apache OpenOffice Apache Zeppelin Apache IoTDB Apache Answer Apache Solr Apache OpenMeetings Apache Ranger Apache JSPWiki Apache Wicket Apache Fineract Apache ActiveMQ Apache Kylin Apache Hadoop Apache Hive
CVE ID Title CVSS Severity Published
CVE-2023-38709 Apache HTTP Server: HTTP response splitting — Apache HTTP Server 7.5 - 2024-04-04
CVE-2024-29008 Apache CloudStack: The extraconfig feature can be abused to load hypervisor resources on a VM instance — Apache CloudStack CWE-20 9.6 - 2024-04-04
CVE-2024-29007 Apache CloudStack: When downloading templates or ISOs, the management server and SSVM follow HTTP redirects with potentially dangerous consequences — Apache CloudStack CWE-918 8.1 - 2024-04-04
CVE-2024-29006 Apache CloudStack: x-forwarded-for HTTP header parsed by default — Apache CloudStack CWE-290 8.1 - 2024-04-04
CVE-2024-29834 Apache Pulsar: Improper Authorization For Namespace and Topic Management Endpoints — Apache Pulsar CWE-863 6.4 Medium 2024-04-02
CVE-2024-23537 Apache Fineract: Under certain circumstances, this vulnerability allowed users, without specific permissions, to escalate their privileges to any role. — Apache Fineract CWE-269 8.4 High 2024-03-29
CVE-2024-23538 Apache Fineract: Under certain system configurations, the sqlSearch parameter was vulnerable to SQL injection attacks, potentially allowing attackers to manipulate database queries. — Apache Fineract CWE-89 9.9 Critical 2024-03-29
CVE-2024-23539 Apache Fineract: Under certain system configurations, the sqlSearch parameter for specific endpoints was vulnerable to SQL injection attacks, potentially allowing attackers to manipulate database queries. — Apache Fineract CWE-89 8.3 High 2024-03-29
CVE-2024-29735 Apache Airflow: Potentially harmful permission changing by log task handler — Apache Airflow CWE-281 8.1AI High AI 2024-03-26
CVE-2024-27438 Apache Doris: Downloading arbitrary remote jar files resulting in remote command execution — Apache Doris CWE-494 8.8AI High AI 2024-03-21
CVE-2024-26307 Apache Doris: Possible race condition — Apache Doris CWE-362 6.5AI Medium AI 2024-03-21
CVE-2024-29131 Apache Commons Configuration: StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator() — Apache Commons Configuration CWE-787 9.8AI Critical AI 2024-03-21
CVE-2024-29133 Apache Commons Configuration: StackOverflowError calling ListDelimiterHandler.flatten(Object, int) with a cyclical object tree — Apache Commons Configuration CWE-787 9.8AI Critical AI 2024-03-21
CVE-2024-27439 Apache Wicket: Possible bypass of CSRF protection — Apache Wicket CWE-352 8.8 - 2024-03-19
CVE-2024-24683 Apache Hop Engine: ID isn't escaped when generating HTML — Apache Hop Engine CWE-20 8.2AI High AI 2024-03-19
CVE-2024-28752 Apache CXF SSRF Vulnerability using the Aegis databinding — Apache CXF CWE-918 9.1 - 2024-03-15
CVE-2024-23944 Apache ZooKeeper: Information disclosure in persistent watcher handling — Apache ZooKeeper CWE-862 5.3 - 2024-03-15
CVE-2024-28746 Apache Airflow: Ignored Airflow Permissions — Apache Airflow CWE-281 4.3AI Medium AI 2024-03-14
CVE-2024-23672 Apache Tomcat: WebSocket DoS with incomplete closing handshake — Apache Tomcat CWE-459 7.5AI High AI 2024-03-13
CVE-2024-24549 Apache Tomcat: HTTP/2 header handling DoS — Apache Tomcat CWE-20 7.5AI High AI 2024-03-13
CVE-2024-27894 Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS Proxying — Apache Pulsar CWE-20 8.5 High 2024-03-12
CVE-2024-27317 Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification — Apache Pulsar CWE-22 8.4 High 2024-03-12
CVE-2024-27135 Apache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code Execution — Apache Pulsar CWE-913 8.5 High 2024-03-12
CVE-2022-34321 Apache Pulsar: Improper Authentication for Pulsar Proxy Statistics Endpoint — Apache Pulsar CWE-306 8.2 High 2024-03-12
CVE-2024-28098 Apache Pulsar: Improper Authorization For Topic-Level Policy Management — Apache Pulsar CWE-863 6.4 Medium 2024-03-12
CVE-2023-41313 Apache Doris: Timing Attack weakness — Apache Doris CWE-208 5.9AI Medium AI 2024-03-12
CVE-2023-50740 Apache Linkis DataSource: DataSource module Oracle SQL Database Password Logged — Apache Linkis DataSource CWE-532 7.5AI High AI 2024-03-06
CVE-2024-26580 Apache InLong: Logged-in user could exploit an arbitrary file read vulnerability — Apache InLong CWE-502 9.1AI Critical AI 2024-03-06
CVE-2024-27138 Apache Archiva: disabling user registration is not effective — Apache Archiva CWE-863 7.5 - 2024-03-01
CVE-2024-27139 Apache Archiva: incorrect authentication potentially leading to account takeover — Apache Archiva CWE-863 9.1 - 2024-03-01

This page lists every published CVE security advisory associated with Apache Software Foundation. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.