Vendor
Apache Software Foundation
2,970 known vulnerabilities.
Products
1,126 results · Clear filters · Feed
-
High 7.5
Apache Axis2/Java: unbounded JSON request body buffering
Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The JSON message builders, including the Gson, Moshi and HTTP/2 variants, buffered the entire request body with no size limit, so an unauthenticated caller could exhaust …
-
High 8.8
Apache Airflow: Execution API: set_xcom skips the reserved-key check, so task-written XComs instantiate airflow.* classes on the API server
Apache Airflow's Task Execution API stored XCom values written by a task without the reserved-key check applied elsewhere, so a Dag author's task could write an XCom that, when a user later viewed it through the API with deserialization enabled, made the API …
-
High 8.7
Apache James: Denial of service upon MIME parsing
Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages. Users are recommended to upgrade to Apache James server 3.9.1 that relies on fixed MIME4J 0.8.15 whic…
-
High 7.5
Apache James MIME4J: Denial of service due to Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsing Mime messages. Users are recommended to upgrade to version 0.8.15 which fixes the issue by enforcing new limits and …
-
High 7.5
Apache James: Negative IMAP ACL administer authorization bypass through JMAP protocol
In Apache James server prior version 3.9.1 improper Access Control List processing is exposed by the JMAP protocol which do not account for negative rules positionned by IMAP protocol. This results in users being able to administer folders in JMAP despite hav…
-
High 8.1
Apache OFBiz: Dispatch arbitrary internal services on SFA component
Improper Control of Resource Identifiers ('Resource Injection') vulnerability in Apache OFBiz. An authenticate user with access to sfa component can override the service to use on vcard import and access to other service. This issue affects Apache OFBiz: befo…
-
High 7.5CVE-2026-68524 Public exploit
Apache OFBiz: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition Loading
An unauthenticated attacker can exploit temporary-file handling, access an open file descriptor, and inject a "file:" URI to cause OFBiz to load an attacker-controlled Screen definition. This issue affects Apache OFBiz: before 24.09.08. Users are recommended …
-
High 7.5CVE-2026-73577 Public exploit
Apache OFBiz: Unauthenticated path-suffix view authorization bypass
Incorrect authorization in RequestHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the authentication requirement of a protected view by appending it as a path suffix to a public request (e.g., …
-
High 7.5
Apache OFBiz: Unauthenticated saved-view authorization bypass with RCE impact
Missing authorization enforcement in RequestHandler.renderView in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to bypass the request-map authentication policy for protected views by supplying a crafted _LAST_VIE…
-
High 8.1
Apache OFBiz: Server-side request forgery in SurveyWrapper
Server-Side Request Forgery in SurveyWrapper in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated back-office user holding catalog permission to cause the server to fetch and render attacker-controlled URLs — including internal netwo…
-
High 7.5
Apache OFBiz: Content renderer runs a service name stored on the row
Improper Authorization in ContentWorker in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to trigger arbitrary OFBiz service invocation with attacker-controlled parameters, resulting in arbitrary file write, arbit…
-
High 7.5
Apache OFBiz: Unbounded multi-form row count from a parameter name
Uncontrolled Resource Consumption in ServiceMultiEventHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to pin a server request thread for an attacker-chosen number of synchronous service dispatches, up to…
-
High 8.8
Apache OFBiz: renderLink compiles link parameters as FreeMarker source
Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in MacroScreenRenderer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the two view permissions…
-
High 8.8
Apache OFBiz: Unsandboxed Groovy compiled from a service parameter
Improper Neutralization of Special Elements Used in an Expression Language Statement ('Expression Language Injection') in EmailServices in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLS_VIEW an…
-
High 7.1
Apache OFBiz: webtools xmldsdump exports any entity to any path
Missing Authorization in XmlDsDump in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the webtools base permissions (OFBTOOLS_VIEW, WEBTOOLS_VIEW) — explicitly not the ENTITY_MAINT permission the export …
-
High 8.8
Apache OFBiz: Widget use-when Expression Injection Bypasses Groovy Sandbox for authenticated RCE
Improper Control of Generation of Code ('Code Injection') in ModelFormField in the Apache OFBiz cms plugin before 24.09.08 on all platforms allows a remote authenticated attacker holding only CMS content-editor access to execute arbitrary operating system com…
-
High 8.8
Apache OFBiz: Content Manager VIEW-only RCE in updateLayout
Incorrect Authorization in the updateLayout simple-method in applications/content/minilang/layout/LayoutEvents.xml in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLS_VIEW and CONTENTMGR_VIEW to …
-
High 8.8
Apache OFBiz: Authenticated Code Execution Vulnerability
Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only a stock non-administrative account to execute a…
-
High 7.3
Apache OFBiz: REST API authentication bypassed by default when the auth attribute is omitted from a .rest.xml operation
Incorrect default value in the REST API framework's .rest.xml definition parser (ModelApiReader) in Apache OFBiz through 24.09.07 on all platforms allows a remote, unauthenticated attacker to invoke a REST API operation without providing valid credentials via…
-
High 7.5
Apache OFBiz: Missing authorization in payment application services allows view-only users to modify payment allocations
Missing check for ACCOUNTING_UPDATE / ACCOUNTING_CREATE in accounting in allows user with only ACCOUNTING_VIEW permission to update/create PaymentApplication. Affected versions before : 24.09.08 Users are recommended to upgrade to version 24.09.08 which fix…
-
High 7.5
Apache OFBiz: Missing authorization in updateOrderItems allows view-only users to modify order prices and quantities
Missing check for ORDERMGR_UPDATE in ordermgr allows user with only ORDERMGR_VIEW permission to update orders. Affected versions before : 24.09.08 Users are recommended to upgrade to version 24.09.08 which fixes this issue.
-
High 7.4
Apache OFBiz: Incorrect Authentication Algorithm Implementation in Password Reset Enables Full Account Takeover
Incorrect Implementation of Authentication Algorithm in the password-reset and login JWT validation in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an attacker who has obtained a user's password-reset token (via email interception, log exposure,…
-
High 8.1
Apache OFBiz: Incorrect Privilege Assignment in Order Manager Enables Unauthorized Modification of Approved Orders
Incorrect Privilege Assignment in the Order Manager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user who holds only order view permissions (ORDERMGR_VIEW), without ORDERMGR_UPDATE or any role on the order, to modify approved…
-
High 7.5
Apache Sling Engine: Hand-rolled parameter parser diverges from RFC/container parsing, enabling smuggling
Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling Engine. The engine's query/form parser accepts non-standard percent-escapes, wrong charsets, and continues request processing on such errors. This i…
-
High 7.5
Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization
Improper output neutralization for logs in Apache Sling Engine. This issue affects Apache Sling Engine: before 3.0.4. Users are recommended to upgrade to version 3.0.4, which fixes the issue.
-
High 8.7
Apache Juneau: Denial of service via unbounded memory allocation in parsers and REST request handling
Allocation of Resources Without Limits or Throttling vulnerability in Apache Juneau. The MessagePack parser, which the REST server enables by default, sizes buffers from length values in the input. An unauthenticated client can send a few bytes that force a m…
-
High 7.3
Apache OpenOffice: Out-of-bounds write when importing encrypted PDF files
An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cause an out-of-bounds memory write, causing program crash or memory corruption. Users are recommended to upgrade to version 4.1.17, whic…
-
High 7.3
Apache OpenOffice: Out of bounds memory access during WMF import
An uncontrolled memory access in the WMF import code of Apache OpenOffice versions through 4.1.16 allows a crafted WMF file to cause an invalid memory access, causing program crash or memory corruption. Users are recommended to upgrade to version 4.1.17, whic…
-
High 7.3
Apache OpenOffice: Stack overflow in CFF hint handling
An uncontrolled memory access in the PDF export code of Apache OpenOffice versions through 4.1.16 allows a crafted CFF font to cause a stack overflow problem, causing program crash or memory corruption, or even running other code. Users are recommended to upg…
-
High 7.3
Apache OpenOffice: Out-of-bounds write when importing encrypted PDF files
An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cause an out-of-bounds memory write, causing program crash or memory corruption. Users are recommended to upgrade to version 4.1.17, whic…
-
High 7.3
Apache OpenOffice: PDF File Parsing Heap based Buffer-Overflow-Remote Code Execution Vulnerability
An unchecked memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 on allows a crafted PDF to execute an out-of-bounds memory write. This could crash the program or cause memory corruption. Users are recommended to upgrade to versi…
-
High 7.3
Apache OpenOffice: Heap out-of-bounds write in WW8 PLCF reader
An out-of-bounds Write vulnerability in Apache OpenOffice versions through 4.1.16 could allow an attacker to craft a Microsoft Word document that would crash the program, or otherwise corrupt other memory areas. Users are recommended to upgrade to version 4.1…
-
High 7.8
Apache OpenOffice: Uncontrolled search path element vulnerability in Windows installer
The Windows installers of Apache OpenOffice 4.1.16 and earlier allow an already manipulated system to run external code with elevated access. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
-
High 7.1
Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handling
Allocation of Resources Without Limits or Throttling in the multiRead request handler of Apache ZooKeeper allows a remote attacker to crash the server (denial of service) with a single small request. The multiRead handler places no limit on the number of bund…
-
High 8.7
Apache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecoverable
Uncontrolled recursion in Apache ZooKeeper. The server serializes its data tree to a snapshot by recursing one stack frame per znode level, with no depth bound. A client permitted to create znodes (the default root ACL is open) can build a chain of nested zno…
-
High 8.7
Apache ZooKeeper: Unauthenticated persistent denial of service via unvalidated quota-node data and paths crashing the transaction-apply thread
Improper handling of exceptional conditions in the quota subsystem of Apache ZooKeeper allows an attacker able to write under the /zookeeper/quota subtree — unauthenticated on default deployments, where that subtree is world-writable — to crash the server's c…
-
High 8.6
Apache ZooKeeper: SASL authorization bypass on the client port through a client-supplied authorization ID
Improper Authorization vulnerability in Apache ZooKeeper. When SASL authentication is enabled on the client port, the server's SASL callback handler grants every authorization identity (authzid) that a client requests, without checking it against the principa…
-
High 7.5
Apache ActiveMQ NMS OpenWire Client Library: Unbounded/Unvalidated Length Fields in Apache.NMS.OpenWire Unmarshalling (DoS)
Unbounded memory allocation and missing frame size validation in Apache NMS ActiveMQ (the .NET OpenWire client, package Apache.NMS.ActiveMQ) before 2.3.0. The OpenWire unmarshalling code trusted the frame size and the length and count fields read from the net…
-
High 8.1
Apache ActiveMQ, Apache ActiveMQ Runtime Config: ActiveMQ retains write access after live ACL revocation
Improper invalidation of cached authorizations vulnerability in Apache ActiveMQ, Apache ActiveMQ Runtime Config. After the runtime configuration plugin removes a principal's write grant on a destination, an authenticated connection opened before the change ca…
-
High 7.5
Apache ActiveMQ, Apache ActiveMQ KahaDB: Oversized client identifier strings poison the KahaDB journal
Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. A user can create a durable subscription with a clientId and subscription name that have a combined length > 65,535 (while separately being shorter) on a broker using KahaDB w…