Apache

In Apache Airflow < 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XS

While investigating a bug report on Apache Superset, it was determined that an authenticated user could craft requests v

Apache Atlas before 2.1.0 contain a XSS vulnerability. While saving search or rendering elements values are not sanitize

In Apache Syncope 2.1.X releases prior to 2.1.7, when the Flowable extension is enabled, an administrator with workflow

An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file uplo

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lea

When using the StreamGenerator, the code parse a user-provided XML. A specially crafted XML, including external system e

Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi"

A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnect

To be able to analyze gradle projects, the build scripts need to be executed. Apache NetBeans follows this pattern. This

In Apache Cassandra, all versions prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8 and 4.0-beta2, it is possible for a local atta

Apache Shiro before 1.6.0, when using Apache Shiro, a specially crafted HTTP request may cause an authentication bypass.

Reported in SOLR-14515 (private) and fixed in SOLR-14561 (public), released in Solr version 8.6.0. The Replication handl

By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker

Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 reques

Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic e

IP address spoofing when proxying using mod_remoteip and mod_rewrite For configurations using proxying with mod_remoteip

Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE

**Resolved** Only when using H2/MySQL/TiDB as Apache SkyWalking storage, there is a SQL injection vulnerability in the w

In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or top

An issue was found in Apache Airflow versions 1.10.10 and below. A stored XSS vulnerability was discovered in the Chart

An issue was found in Apache Airflow versions 1.10.10 and below. It was discovered that many of the admin management scr

An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attack can connect to

An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect t

An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was disco

XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03

IDOR vulnerability in the order processing feature from ecommerce component of Apache OFBiz before 17.12.04

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to

An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release

This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unr

Kylin concatenates and executes a Hive SQL in Hive CLI or beeline when building a new segment; some part of the HQL is f

Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then exe

Server-Side Template Injection and arbitrary file disclosure on Camel templating components

Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual chann

Apache Guacamole 1.1.0 and older do not properly validate datareceived from RDP servers via static virtual channels. If

**Resolved** When use H2/MySQL/TiDB as Apache SkyWalking storage, the metadata query through GraphQL protocol, there is

A Incorrect Default Permissions vulnerability in the packaging of tomcat on SUSE Enterprise Storage 5, SUSE Linux Enterp

A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5

A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently store

Apache Traffic Server 6.0.0 to 6.2.3, 7.0.0 to 7.1.10, and 8.0.0 to 8.0.7 is vulnerable to certain types of HTTP/2 HEADE

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (s

Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may caus

Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection. A attacker is able to retrieve user attribute

If Apache TomEE is configured to use the embedded ActiveMQ broker, and the broker URI includes the useJMX=true parameter

In Karaf, JMX authentication takes place using JAAS and authorization takes place using ACL files. By default, only an "

Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the J

Apache Ignite uses H2 database to build SQL distributed execution engine. H2 provides SQL functions which could be used

Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the

Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set.

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a)