Apache

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio

In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configu

Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via S

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Lo

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in con

Apache Airavata Django Portal allows CRLF log injection because of lack of escaping log statements. In particular, some

Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a

A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Denounce

The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification. The $request_uri is the full

In Apache Ozone before 1.2.0, Recon HTTP endpoints provide access to OM, SCM and Datanode metadata. Due to a bug, any un

In Apache Ozone before 1.2.0, Authenticated users with valid Ozone S3 credentials can create specific OM requests, imper

In Apache Ozone before 1.2.0, Ozone Datanode doesn't check the access mode parameter of the block token. Authenticated u

In Apache Ozone versions prior to 1.2.0, Authenticated users knowing the ID of an existing block can craft specific requ

In Apache Ozone versions prior to 1.2.0, Container related Datanode requests of Ozone Datanode were not properly authori

In Apache Ozone versions prior to 1.2.0, certain admin related SCM commands can be executed by any authenticated users,

In Apache Ozone versions prior to 1.2.0, Various internal server-to-server RPC endpoints are available for connections,

In Apache Ozone versions prior to 1.2.0, Initially generated block tokens are persisted to the metadata database and can

Improper output neutralization for Logs. A specific Apache Superset HTTP endpoint allowed for an authenticated user to f

A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass a

Apache Superset up to and including 1.3.1 allowed for database connections password leak for authenticated users. This i

An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the P

Deserialization of Untrusted Data vulnerability of Apache ShardingSphere-UI allows an attacker to inject outer link reso

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the stats-over-http plugin of Ap

Improper Input Validation vulnerability in accepting socket connections in Apache Traffic Server allows an attacker to m

Improper Authentication vulnerability in TLS origin verification of Apache Traffic Server allows for man in the middle a

Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle request

Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle request

Improper input validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle request

In Apache DolphinScheduler before 1.3.6 versions, authorized users can use SQL injection in the data source center. (Onl

In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. T

An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre

A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Ap

Apache Superset up to and including 1.3.0 when configured with ENABLE_TEMPLATE_PROCESSING on (disabled by default) allow

Apache Superset up to and including 1.1 does not sanitize titles correctly on the Explore page. This allows an attacker

The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60

In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML attachmen

An authenticated Apache Traffic Control Traffic Ops user with Portal-level privileges can send a request with a speciall

It is possible for an attacker to manipulate documents to appear to be signed by a trusted source. All versions of Apach

It is possible for an attacker to manipulate the timestamp of signed documents. All versions of Apache OpenOffice up to

It is possible for an attacker to manipulate signed documents and macros to appear to come from a trusted source. All ve

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path

Apache OpenOffice has a dependency on expat software. Versions prior to 2.1.0 were subject to CVE-2013-0340 a "Billion L

While working on Apache OpenOffice 4.1.8 a developer discovered that the DEB package did not install using root, but ins

A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path trave

While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing a

Apache DB DdlUtils 1.0 included a BinaryObjectsHelper that was intended for use when migrating database data with a SQL

In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP In

Apache OpenOffice opens dBase/DBF documents and shows the contents as spreadsheets. DBF are database files with data org

Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks