Apache

This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in t

In Apache Hive 2.1.0 to 2.3.2, when 'COPY FROM FTP' statement is run using HPL/SQL extension to Hive, a compromised/mali

In Apache Hive 0.6.0 to 2.3.2, malicious user might use any xpath UDFs (xpath/xpath_string/xpath_boolean/xpath_number/xp

This vulnerability in Apache Hive JDBC driver 0.7.1 to 2.3.2 allows carefully crafted arguments to be used to bypass the

In Apache Ignite 2.3 or earlier, the serialization mechanism does not have a list of classes allowed for serialization/d

The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a m

In Apache httpd 2.2.0 to 2.4.29, when generating an HTTP Digest authentication challenge, the nonce sent to prevent repl

A specially crafted HTTP request header could have crashed the Apache HTTP Server prior to version 2.4.30 due to an out

When an HTTP/2 stream was destroyed after being handled, the Apache HTTP Server prior to version 2.4.30 could have writt

A specially crafted request could have crashed the Apache HTTP Server prior to version 2.4.30, due to an out of bound ac

In Apache httpd 2.4.0 to 2.4.29, when mod_session is configured to forward its session data to CGI applications (Session

In Apache httpd 2.4.0 to 2.4.29, the expression specified in <FilesMatch> could match '$' to a newline character in a ma

In Apache httpd 2.0.23 to 2.0.65, 2.2.0 to 2.2.34, and 2.4.0 to 2.4.29, mod_authnz_ldap, if configured with AuthLDAPChar

An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupporte

An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and un

If a user of Apache Commons Email (typically an application programmer) passes unvalidated input as the so-called "Bounc

A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field par

In Apache Allura prior to 1.8.1, attackers may craft URLs that cause HTTP response splitting. If a victim goes to a mali

The IIS/ISAPI specific code in the Apache Tomcat JK ISAPI Connector 1.2.0 to 1.2.42 that normalised the requested path b

Apache HTTP Server mod_cluster before version httpd 2.4.23 is vulnerable to an Improper Input Validation in the protocol

It was found that when Artemis and HornetQ before 2.4.0 are configured with UDP discovery and JGroups discovery a huge b

The ODE process deployment web service was sensible to deployment messages with forged names. Using a path for the name

In Apache Xerces-C XML Parser library before 3.2.1, processing of external DTD paths can result in a null pointer derefe

The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomc

In Apache OpenMeetings 3.0.0 - 4.0.1, CRUD operations on privileged users are not password protected allowing an authent

There is a DOS attack vulnerability in Apache Traffic Server (ATS) 5.2.0 to 5.3.2, 6.0.0 to 6.2.0, and 7.0.0 with the TL

There is a vulnerability in Apache Traffic Server (ATS) 6.2.0 and prior and 7.0.0 and prior with the Host header and lin

Two XSS vulnerabilities were fixed in message list and view in the Hupa Webmail application from the Apache James projec

In Apache Geode before v1.4.0, the Geode server stores application objects in serialized form. Certain cluster operation

In Apache Geode before v1.4.0, the TcpServer within the Geode locator opens a network port that deserializes data. If an

When an Apache Geode cluster before v1.4.0 is operating in secure mode, the Geode configuration service does not properl

Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 t

The qpidd broker in Apache Qpid 0.30 and earlier allows remote authenticated users to cause a denial of service (daemon

The Privileges portion of the web GUI and the XMLRPC API in Apache VCL 2.3.x before 2.3.2, 2.2.x before 2.2.2 and 2.1 al

The console in Apache jUDDI 3.0.0 does not properly escape line feeds, which allows remote authenticated users to spoof

Apache Karaf prior to 4.0.8 used the LDAPLoginModule to authenticate users to a directory via LDAP. However, it did not

Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 4.3.0 and 5.0.0-beta1 to expose private files on the Ooz

In Apache JMeter 2.X and 3.X, when using Distributed Test only (RMI based), jmeter server binds RMI Registry to wildcard

A Denial of Service vulnerability was found in Apache Qpid Dispatch Router versions 0.7.0 and 0.8.0. To exploit this vul

When using the OpenWire protocol in ActiveMQ versions 5.14.0 to 5.15.2 it was found that certain system details (such as

When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could all

The Windows installer that the Apache CouchDB team provides was vulnerable to local privilege escalation. All files in t

The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an e

In Apache jUDDI 3.2 through 3.3.4, if using the WADL2Java or WSDL2Java classes, which parse a local or remote XML docume

A Denial of Service vulnerability was found in Apache Qpid Broker-J 7.0.0 in functionality for authentication of connect

In Apache Allura before 1.8.0, unauthenticated attackers may retrieve arbitrary files through the Allura web application

Apache CloudStack 4.1 to 4.8.1.0 and 4.9.0.0 contain an API call designed to allow a user to register for the developer

In Apache CloudStack 4.1.0 and 4.1.1, when calling the CloudStack API call listProjectAccounts as a regular, non-adminis

After the Android platform is added to Cordova the first time, or after a project is created using the build scripts, th

As part of the fix for bug 61201, the documentation for Apache Tomcat 9.0.0.M22 to 9.0.1, 8.5.16 to 8.5.23, 8.0.45 to 8.