Vendor
Apache Software Foundation
3,000 known vulnerabilities.
Products
3,000 results · Feed
-
Unscored —
The embedded HTTP server does not clear the security identity established during a request before its worker thread han…
-
Unscored —
The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id…
-
Unscored —
Apache TomEE: Code execution by any authenticated user via the SSH administration shell
The optional SSH administration service grants full access to the administration shell to every user that authenticates against its configured login domain, without checking for an administrative role. An attacker holding the credentials of any user in that d…
-
Unscored —
The JDBC based JAAS login module accepts a login without a password for accounts whose stored password is NULL. A remot…
-
Unscored —
When a non-default stateful session bean passivation strategy is configured, passivated bean state is written to predic…
-
Unscored —
When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state establishe…
-
Unscored —
A negative MicroProfile JWT clock skew setting is not rejected and disables validation of the token expiration and othe…
-
Unscored —
When MicroProfile JWT role-based access control is used, the access constraints of JAX-RS resources are not always enfo…
-
Unscored —
After a successful WS-Security UsernameToken authentication, the caller identity stays associated with the worker threa…
-
Unscored —
The embedded OpenEJB HTTP server does not isolate HTTP sessions between web applications. A remote attacker can use a s…
-
Unscored —
When resolving security roles of a realm-authenticated caller, the caller's user name is also treated as a role name in…
-
Unscored —
The Jakarta Security identity store backed by the Tomcat user database compares the supplied password with the stored v…
-
Unscored —
The development-time LiveReload support listens on all network interfaces without authentication and accepts websocket …
-
Unscored —
The embedded OpenEJB HTTP server reports every request as authenticated when an application requests authentication pro…
-
Unscored —
The admin service of the standalone OpenEJB server accepts stop requests without any authentication. Any local user or …
-
Unscored —
When JAX-WS or JAX-RS endpoints are published by the embedded OpenEJB HTTP server rather than Tomcat, some configured a…
-
Unscored —
With the default configuration and no users defined in the default user database, TomEE silently adds an administrative…
-
Unscored —
The optional request routing feature forwards requests to their configured destination without applying the security co…
-
Unscored —
The embedded server generates HTTP session identifiers with a non-cryptographic random number generator by default. A r…
-
Unscored —
The Jakarta Security OpenID Connect authentication mechanism generates the state and nonce values with a non-cryptograp…
-
Unscored —
The Jakarta Security LDAP identity store accepts an empty password as valid if the directory server allows unauthentica…
-
Unscored —
Apache TomEE: LDAP injection in LDAP identity store
The Jakarta Security LDAP identity store does not neutralize special characters in the caller name before using it in directory queries. A remote unauthenticated attacker can alter the queries to enumerate accounts, infer directory attribute values, or influe…
-
Unscored —
Apache TomEE: Missing authentication on EJB web service endpoints deployed in a web application
Authentication configured for an EJB JAX-WS endpoint in the TomEE deployment descriptor is not enforced when the endpoint is published within an existing web application. A remote unauthenticated attacker can invoke the web service operations, unless the appl…
-
Unscored —
Apache TomEE: Authentication bypass on EJB web service endpoints via HTTP method
The security constraint generated for EJB JAX-WS endpoints with configured authentication protects only some HTTP methods. A remote unauthenticated attacker can bypass authentication by sending requests with another HTTP method. Users are recommended to upgra…
-
Unscored —
Apache TomEE: Missing authorization on internal deployer EJBs in default profile
The internal system EJBs used for remote deployment and configuration did not enforce their administrative role check when the server ran with the default profile. A remote unauthenticated attacker able to reach the remote EJB endpoint could deploy arbitrary …
-
Unscored —
Apache TomEE: Stateful session bean hijacking via predictable session identifiers
Stateful session bean identifiers are not generated from a cryptographically secure random source. A remote attacker with access to the EJB remote endpoint who holds one valid identifier can derive those of other clients' sessions and invoke methods on their …
-
Unscored —
Apache TomEE: Path traversal via stateful EJB passivation
The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without validating it. A remote attacker with access to the remote EJB service can cause session state to be read from or written to files outside …
-
Unscored —
Apache TomEE: Username enumeration and timing side channel in JAAS login modules
The bundled JAAS login modules leak whether a username exists and compare credentials in a non-constant-time manner. A remote unauthenticated attacker can enumerate valid accounts and may infer credential material through timing analysis. Users are recommende…
-
Unscored —
Apache Commons Codec: Blake3 doFinalize is stateless; the documented KDF example derives identical keys
Apache Commons Codec's Blake3 class documented the output of its doFinalize methods as depending on any previously finalized bytes, so that consecutive calls would return different output. In fact, doFinalize does not change the hash state: calling it again w…
-
Unscored —
Apache Commons Codec: NUL bytes in tree entry names cause Git/SWHID identifier collisions (GitIdentifiers class)
The GitIdentifiers class in Apache Commons Codec did not reject NUL bytes in tree entry names. Because Git uses a NUL byte to mark the end of each entry name in a tree object, a crafted name could make one tree serialize to the same bytes as a different tree.…
-
High 7.5
Apache Axis2/Java: unbounded JSON request body buffering
Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The JSON message builders, including the Gson, Moshi and HTTP/2 variants, buffered the entire request body with no size limit, so an unauthenticated caller could exhaust …
-
Unscored —
Apache Axis2/Java: exposeServiceMetadata not enforced on all metadata routes
Direct Request ('Forced Browsing') vulnerability in Apache Axis2/Java. The exposeServiceMetadata service parameter was enforced only on the ?wsdl, ?wsdl2 and ?xsd queries. For a service that had disabled it, the packaged .wsdl and .xsd file routes, the named-…
-
Unscored —CVE-2026-123753 Public exploit
Apache Axis2/Java: SSRF via WS-Addressing ReplyTo and FaultTo endpoints
Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. An unauthenticated caller could supply a non-anonymous WS-Addressing wsa:ReplyTo or wsa:FaultTo address, and Axis2 would open a connection to that address to deliver the response or fault,…
-
Unscored —
Apache Axis2/Java: Cross-site scripting in the OpenAPI module's Swagger UI page
Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability in the OpenAPI module of Apache Axis2/Java. The Swagger UI page served by the OpenAPI module wrote a value derived from the request's Host header into the page wi…
-
Unscored —
Apache Axis2/Java: Unbounded multipart and form-encoded request bodies
Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The multipart/form-data and application/x-www-form-urlencoded message builders read the request body directly from the transport stream with no size limit, so the servlet…
-
Unscored —
Apache Axis2/Java: XML External Entity (XXE) injection via imported WSDL/XSD documents
Improper Restriction of XML External Entity Reference vulnerability in Apache Axis2/Java. When a client built an AxisService from a WSDL URL, through ServiceClient or AxisService.createClientSideAxisService, wsdl4j import resolution was enabled and the docume…
-
Unscored —
Apache Axis2/Java: SSRF via WSDL/XSD schema import resolution
Server-Side Request Forgery (SSRF) vulnerability in Apache Axis2/Java. When Axis2 built a service description from a WSDL, through ServiceClient, AxisService.createClientSideAxisService or WSDLToAxisServiceBuilder, it fetched the absolute URLs in wsdl:import …
-
Unscored —
Apache Allura: OAuth1 rebinding
OAuth 1 rebinding vulnerability in Apache Allura. This issue affects Apache Allura: through 1.22.0. Users are recommended to upgrade to version 1.22.1, which fixes the issue.
-
Unscored —
Description `DefaultStateSerializer`, used to persist and restore stateful bolt checkpoints, configured Kryo with class…
-
Unscored —
Description Nimbus instantiates the class named by a topology's `topology.scheduler.strategy` when scheduling it. The a…