Apache

In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() meth

Apache OpenMeetings 1.0.0 updates user password in insecure manner.

Apache OpenMeetings 1.0.0 responds to the following insecure HTTP methods: PUT, DELETE, HEAD, and PATCH.

Apache OpenMeetings 1.0.0 doesn't check contents of files being uploaded. An attacker can cause a denial of service by u

Apache OpenMeetings 1.0.0 displays Tomcat version and detailed error stack trace, which is not secure.

Apache OpenMeetings 3.2.0 is vulnerable to parameter manipulation attacks, as a result attacker has access to restricted

Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. This allows authenticated users to modify the structure of the

Apache OpenMeetings 1.0.0 has an overly permissive crossdomain.xml file. This allows for flash content to be loaded from

Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget pas

Apache OpenMeetings 1.0.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks, XSS attacks, click-jacking, and MI

Uploaded XML documents were not correctly validated in Apache OpenMeetings 3.1.0.

Both global and Room chat are vulnerable to XSS attack in Apache OpenMeetings 3.2.0.

The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a den

The weblog page template in Apache Roller 5.1 through 5.1.1 allows remote authenticated users with admin privileges for

When under stress, closing many connections, the HTTP/2 handling code in Apache httpd 2.4.26 would sometimes access memo

In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'D

When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack. Solution is to up

If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a spe

In Apache Spark before 2.2.0, it is possible for an attacker to take advantage of a user's trust in the server to trick

During a routine security analysis, it was found that one of the ports in Apache Impala (incubating) 2.7.0 to 2.8.0 sent

It was noticed that a malicious process impersonating an Impala daemon in Apache Impala (incubating) 2.7.0 to 2.8.0 coul

The Traffic Router component of the incubating Apache Traffic Control project is vulnerable to a Slowloris style Denial

The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passe

Apache Solr uses a PKI based mechanism to secure inter-node communication when security is enabled. It is possible to cr

Apache Ignite 1.0.0-RC3 to 2.0 uses an update notifier component to update the users about new project releases that inc

In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when se

The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which al

In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party mod

In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules ou

The client libraries in Apache Thrift before 0.9.3 might allow remote authenticated users to cause a denial of service (

In environments that use external location for hive tables, Hive Authorizer in Apache Ranger before 0.7.1 should be chec

Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '*' wildcard character - like my*test, te

Apache Ranger before 0.6.3 is vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions. Adm

Apache Ranger before 0.6.3 policy engine incorrectly matches paths in certain conditions when policy does not contain wi

Apache NiFi before 0.7.4 and 1.x before 1.3.0 need to establish the response header telling browsers to only allow frami

In Apache NiFi before 0.7.4 and 1.x before 1.3.0, there are certain user input components in the UI which had been guard

Application plugins in Apache CXF Fediz before 1.1.3 and 1.2.x before 1.2.1 allow remote attackers to cause a denial of

The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote attackers to cause a

The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is conf

In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with ins

Apache Hive (JDBC + HiveServer2) implements SSL for plain TCP and HTTP connections (it supports both transport modes). W

For versions of Apache Knox from 0.2.0 to 0.11.0 - an authenticated user may use a specially crafted URL to impersonate

Two errors in the "asn1_find_node()" function (lib/parser_aux.c) within GnuTLS libtasn1 version 4.10 can be exploited to

Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery (CSRF) attacks. A

After logging into the portal, the logout jsp page redirects the browser back to the login page after. It is feasible fo

Apache CXF Fediz ships with an OpenId Connect (OIDC) service which has a Client Registration Service, which is a simple

Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF (Cro

In Ambari 2.2.2 through 2.4.2 and Ambari 2.5.0, sensitive data may be stored on disk in temporary files on the Ambari Se

The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user auth

In Ambari 2.4.x (before 2.4.3) and Ambari 2.5.0, an authorized user of the Ambari Hive View may be able to gain unauthor