Apache

A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code exec

A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file

Apache Flink 1.5.1 introduced a REST handler that allows you to write an uploaded file to an arbitrary location on the l

Apache Accumulo versions 1.5.0 through 1.10.0 and version 2.0.0 do not properly check the return value of some policy en

Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a maliciou

In the Pulsar manager 0.1.0 version, malicious users will be able to bypass pulsar-manager's admin, permission verificat

In DolphinScheduler 1.2.0 and 1.2.1, with mysql connectorj a remote code execution vulnerability exists when choosing my

An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility me

If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5 is configured to use the embedded Activ

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Fo

In Apache Airflow versions prior to 1.10.13, the Charts and Query View of the old (Flask-admin based) UI were vulnerable

In Airflow versions prior to 1.10.13, when creating a user using airflow CLI, the password gets logged in plain text in

The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects

Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected

Out-of-bounds Write vulnerability in TCP Stack of Apache NuttX (incubating) versions up to and including 9.1.0 and 10.0.

Out-of-bounds Write vulnerability in TCP stack of Apache NuttX (incubating) versions up to and including 9.1.0 and 10.0.

A Java Serialization vulnerability was found in Apache Tapestry 4. Apache Tapestry 4 will attempt to deserialize the "sp

Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's impleme

In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the

While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allow

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request U

We have resolved a security issue in the camera plugin that could have affected certain Cordova (Android) applications.

In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2

It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed

A flaw in the libapreq2 v2.07 to v2.13 multipart parser can deference a null pointer leading to a process crash. A remot

A vulnerability in Apache OpenOffice scripting events allows an attacker to construct documents containing hyperlinks po

XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to ru

Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attri

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This

The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but th

Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentica

In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta

Web endpoint authentication check is broken in Apache Hadoop 3.0.0-alpha4, 3.0.0-beta1, and 3.0.0. Authenticated users m

Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.

Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (whic

The implementation of POST with the username and password in the URL parameters exposed the credentials. More infomratio

In JUnit4 from version 4.7 and before 4.13.1, the test rule TemporaryFolder contains a local information disclosure vuln

If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded t

HttpUtils#getURLConnection method disables explicitly hostname verification for HTTPS connections making clients vulnera

In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were protected by mandating TLS v1.2, as well as listening connectio

In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token (one-time password) mechanism used a fixed cache size and did no

In Apache NiFi 1.10.0 to 1.11.4, the NiFi stateless execution engine produced log output which included sensitive proper

In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider o

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the

In the course of work on the open source project it was discovered that authenticated users running queries against Hive

In Apache Tapestry from 5.4.0 to 5.5.0, crafting specific URLs, an attacker can download files inside the WEB-INF folder

Attackers can use public NetTest web service of Apache OpenMeetings 4.0.0-5.0.0 to organize denial of service attack.

In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets with