Skip to content
OpenAdvisories

Vendor

Apache Software Foundation

3,000 known vulnerabilities.

Products

Apache Airflow 169 Apache HTTP Server 142 Apache Tomcat 141 Apache Traffic Server 111 Apache OFBiz 97 Apache Camel 97 Apache Thrift 90 Apache Superset 65 Apache CXF 56 Apache CloudStack 51 Apache NiFi 47 Apache DolphinScheduler 46 Apache Syncope 45 Apache InLong 41 Apache bRPC 41 Apache Kylin 40 Apache ActiveMQ 40 Apache Wicket 40 Apache OpenOffice 39 Apache TomEE 39 Apache Roller 39 Apache Answer 37 Apache APISIX 34 Apache Struts 33 Apache Pulsar 30 Apache IoTDB 28 Apache Zeppelin 25 Apache Solr 24 Apache OpenMeetings 23 Apache Ranger 23 Apache Kafka 23 Apache Fineract 22 Apache JSPWiki 22 Apache ActiveMQ All 20 Apache ZooKeeper 19 Apache Allura 19 Apache Qpid Broker-J 19 Apache Geode 18 Apache Hadoop 18 Apache Hive 18
All Critical High Medium Low Exploited only Public exploit

128 results · Clear filters · Feed

  • High 7.5
    CVE-2018-1306 Public exploit EPSS 42%

    Exposure of Sensitive Information in Apache Pluto

    The PortletV3AnnotatedDemo Multipart Portlet war file code provided in Apache Pluto version 3.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to restrict path information provided during a file upload. An attacker coul…

    Apache Software Foundation Apache Pluto org.apache.portals.pluto:pluto-container Maven
  • High 8.1
    CVE-2018-1335 Public exploit EPSS 94%

    Command injection in org.apache.tika:tika-core

    From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a se…

    Apache Software Foundation Apache Tika tika tika Debian Ubuntu Maven
  • High 7.2
    CVE-2018-1321 Public exploit EPSS 18%

    High severity vulnerability that affects org.apache.syncope:syncope-core

    An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can use XSL Transformations (XSLT) to perform malicious operations, includin…

    Apache Software Foundation Apache Syncope org.apache.syncope:syncope-core Maven
  • High 7.5
    CVE-2017-5637 Public exploit EPSS 73%

    Uncontrolled Resource Consumption in Apache ZooKeeper

    Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Apache ZooKeeper thru version 3.4.9 and 3.5.2 suff…

    Apache Software Foundation Apache ZooKeeper zookeeper zookeeper Debian Ubuntu Maven
  • High 8.1
    CVE-2017-12617 Exploited Public exploit EPSS 100%

    Unrestricted Upload of File with Dangerous Type Apache Tomcat

    When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP fil…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
    KEV Mar 25, 2022
  • High 8.1
    CVE-2017-12615 Exploited · Ransomware Public exploit EPSS 100%

    When running Apache Tomcat on Windows with HTTP PUTs enabled it was possible to upload a JSP file to the server

    When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could th…

    Apache Software Foundation Apache Tomcat org.apache.tomcat.embed:tomcat-embed-core Maven
    KEV Mar 25, 2022
  • High 8.1
    CVE-2017-9805 Exploited Public exploit EPSS 99%

    REST Plugin in Apache Struts uses an XStreamHandler with an instance of XStream for deserialization without any type filtering

    The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloa…

    Apache Software Foundation Apache Struts org.apache.struts:struts2-rest-plugin Maven
    KEV Nov 3, 2021
  • High 7.1
    CVE-2016-6816 Public exploit EPSS 40%

    Improper Input Validation in Apache Tomcat

    The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven