Apache

Apache Hadoop’s RunJar.run() does not set permissions for temporary directory by default. If sensitive data will be pres

In Apache Linkis <= 1.5.0, a Random string security vulnerability in Spark EngineConn, random string generated by the To

Incorrect Default Permissions vulnerability in Apache Tomcat Connectors allows local users to view and modify shared mem

SnakeYaml Deser Load Malicious xml rce vulnerability in Apache HertzBeat (incubating).  This vulnerability can only be

Apache Druid allows users with certain permissions to read data from other database systems using JDBC. This functionali

Padding Oracle vulnerability in Apache Druid extension, druid-pac4j. This could allow an attacker to manipulate a pac4j

Deserialization of Untrusted Data vulnerability in Apache Seata.  When developers disable authentication on the Seata-S

Example DAG: example_inlet_event_extra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows an

Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG fold

Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OF

Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Us

Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to name

Apache Airflow, versions before 2.10.0, have a vulnerability that allows the developer of a malicious provider to execut

Mysql security vulnerability in Apache SeaTunnel. Attackers can read files on the MySQL server by modifying the informa

** UNSUPPORTED WHEN ASSIGNED ** The Apache Helix Front (UI) component contained a hard-coded secret, allowing an attacke

Hertzbeat is an open source, real-time monitoring system. Hertzbeat has an authenticated (user role) RCE via unsafe dese

Hertzbeat is an open source, real-time monitoring system. Hertzbeat 1.6.0 and earlier declares a /api/monitor/{monitorId

Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.2.

Like many other SSH implementations, Apache MINA SSHD suffered from the issue that is more widely known as CVE-2023-4879

Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer:

Missing Release of Resource after Effective Lifetime vulnerability in Apache Answer. This issue affects Apache Answer:

File read and write vulnerability in Apache DolphinScheduler ,  authenticated users can illegally access additional reso

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandbox

In Apache CloudStack 4.19.1.0, a regression in the network listing API allows unauthorised list access of network detail

CloudStack account-users by default use username and password based authentication for API and UI access. Account-users

** UNSUPPORTED WHEN ASSIGNED ** Server-Side Request Forgery (SSRF) vulnerability in Apache IoTDB Workbench. This issue

Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are re

Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB. This issue affects Apache Airflow Provid

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache InLong. This issue affects Apache InL

In Apache Linkis <= 1.5.0, Arbitrary file deletion in Basic management services on A user with an administrator accou

In Apache Linkis <= 1.5.0, Privilege Escalation in Basic management services where the attacking user is a trusted ac

Web Authentication vulnerability in Apache SeaTunnel. Since the jwt key is hardcoded in the application, an attacker can

Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests. This

Apache Traffic Server forwards malformed HTTP chunked trailer section to origin servers. This can be utilized for reques

Apache Traffic Server accepts characters that are not allowed for HTTP field names and forwards malformed requests to or

Insufficient input validation and sanitation in Profile name & screenname, Bookmark name & description and blogroll name

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Pinot. This issue affects Apache Pin

XXE in the XML Format Plugin in Apache Drill version 1.19.0 and greater allows a user to read any file on a remote file

Exposure of temporary credentials in logs in Apache Arrow Rust Object Store (`object_store` crate), version 0.10.1 and e

On versions before 2.1.4, session is not invalidated after logout. When the user logged in successfully, the Backend ser

When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could le

On versions before 2.1.4, after a regular user successfully logs in, they can manually make a request using the authoriz

For RocketMQ versions 5.2.0 and below, under certain conditions, there is a risk of exposure of sensitive Information to

The CloudStack SAML authentication (disabled by default) does not enforce signature check. In CloudStack environments wh

In versions of Apache CXF before 3.6.4 and 4.0.5 (3.5.x and lower versions are not impacted), a CXF HTTP client conduit

An improper input validation of the p2c parameter in the Apache CXF JOSE code before 4.0.5, 3.6.4 and 3.5.9 allows an at

A SSRF vulnerability in WADL service description in versions of Apache CXF before 4.0.5, 3.6.4 and 3.5.9 allows an attac

On versions before 2.1.4, a user could log in and perform a template injection attack resulting in Remote Code Execution

SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes t

A partial fix for  CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type b