Apache

It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow 0

Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Conn

Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. This

In Apache Impala 2.7.0 to 3.2.0, an authenticated user with access to the IDs of active Impala queries or sessions can i

Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class an

A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript

In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when f

In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with

Hadoop 1.0.3 contains a symlink vulnerability.

In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a spe

Apache Traffic Server is vulnerable to HTTP/2 setting flood attacks. Earlier versions of Apache Traffic Server didn't li

Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in

The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resulta

In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group informa

Handling of the close_notify SSL/TLS message does not lead to a connection closure, leading the server to retain the soc

In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using t

In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page

In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memor

In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit

In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit

In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential m

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerabilit

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerabilit

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerabilit

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerabilit

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerabilit

The code which checks HMAC in form submissions used String.equals() for comparisons, which results in a timing side chan

Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -> AssetDispatcher -> ContextResource`, w

Manipulating classpath asset file URLs, an attacker could guess the path to a known file in the classpath and have it do

An RCE is possible by entering Freemarker markup in an Apache OFBiz Form Widget textarea field when encoding has been di

The "Blog", "Forum", "Contact Us" screens of the template "ecommerce" application bundled in Apache OFBiz are weak to St

The java.io.ObjectInputStream is known to cause Java serialisation issues. This issue here is exposed by the "webtools/c

The Apache OFBiz HTTP engine (org.apache.ofbiz.service.engine.HttpEngine.java) handles requests for HTTP services via th

Solr versions 1.3.0 to 1.4.1, 3.1.0 to 3.6.2 and 4.0.0 to 4.10.4 are vulnerable to an XML resource consumption attack (a

Improper authentication is possible in Apache Traffic Control versions 3.0.0 and 3.0.1 if LDAP is enabled for login in t

The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop w

Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c

An issue was discovered in the protobuf crate before 2.6.0 for Rust. Attackers can exhaust all memory via Vec::reserve c

In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for a

HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with "H2PushResource", could lead to an overwri

Some HTTP/2 implementations are vulnerable to a flood of empty frames, potentially leading to a denial of service. The a

Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of s

Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker se

Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. The attacker

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker op

Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker c

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker send

Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potential

Policy import functionality in Apache Ranger 0.7.0 to 1.2.0 is vulnerable to a cross-site scripting issue. Upgrade to 2.