Apache

Apache Jena SDB 3.17.0 and earlier is vulnerable to a JDBC Deserialisation attack if the attacker is able to control the

In the default configuration of Apache SOAP, an RPCRouterServlet is available without authentication. This gives an atta

A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arb

A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for task

When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied "

Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However

With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fl

The Apache Pulsar C++ Client does not verify peer TLS certificates when making HTTPS calls for the OAuth2.0 Client Crede

A relative path traversal vulnerability in a FileUtil class used by the PEAR management component of Apache UIMA allows

An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling

In Apache Airflow versions prior to 2.4.2, there was an open redirect in the webserver's `/confirm` endpoint.

In Apache Airflow versions prior to 2.4.2, the "Trigger DAG with config" screen was susceptible to XSS attacks via the `

When users add resources to the resource center with a relation path will cause path traversal issues and only for logge

A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers

If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to igno

Users can read any files by log server, Apache DolphinScheduler users should upgrade to version 2.0.6 or higher.

Apache IoTDB version 0.12.2 to 0.12.6, 0.13.0 to 0.13.2 are vulnerable to a Denial of Service attack when accepting untr

Apache Flume versions 1.4.0 through 1.10.1 are vulnerable to a remote code execution (RCE) attack when a configuration u

In Apache Linkis <=1.2.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code

A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. T

A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue af

Apache Geode versions up to 1.15.0 are vulnerable to a Cross-Site Scripting (XSS) via data injection when using Pulse we

Heron versions <= 0.20.4-incubating allows CRLF log injection because of the lack of escaping in the log statements. Ple

When running in prototype mode, the h2 webconsole module (accessible from the Prototype menu) is automatically made avai

Prior to 2.0.0-M9, it was possible for an end-user to set the value of an editable string property of a domain object to

A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malic

Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The s

Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configura

Apache Shiro before 1.10.0, Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatc

In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being

** DISPUTED ** This record was originally reported by the oss-fuzz project who failed to consider the security context i

** DISPUTED ** This record was originally reported by the oss-fuzz project who failed to consider the security context i

The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwa

Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer TLS certificates, eve

TLS hostname verification cannot be enabled in the Pulsar Broker's Java Client, the Pulsar Broker's Java Admin Client, t

Delayed TLS hostname verification in the Pulsar Java Client and the Pulsar Proxy make each client vulnerable to a man in

Improper Input Validation vulnerability in Proxy component of Apache Pulsar allows an attacker to make TCP/IP connection

In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in un

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to access files usin

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external re

Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to load a url thru t

An Improper Restriction of XML External Entity Reference vulnerability in RPCRouterServlet of Apache SOAP allows an atta

In Apache Airflow 2.3.0 through 2.3.4, there was an open redirect in the webserver's `/confirm` endpoint.

In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extr

In versions of Apache InLong prior to 1.3.0, an attacker with sufficient privileges to specify MySQL JDBC connection URL

A security vulnerability has been identified in Apache Kafka. It affects all releases since 2.8.0. The vulnerability all

Apache Calcite 1.22.0 introduced the SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM and EXTRACT_VALUE do not rest

Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS com

Apache IoTDB grafana-connector version 0.13.0 contains an interface without authorization, which may expose the internal

Apache IoTDB version 0.13.0 is vulnerable by session id attack. Users should upgrade to version 0.13.1 which addresses t