Skip to content
OpenAdvisories

Vendor

Apache

91 known vulnerabilities.

Products

Apache HTTP Server 5 Apache Tomcat 5 OFBiz 4 Apache Tika 4 Apache OFBiz 4 VCL 3 Olingo 3 Apache Solr 2 Kafka 2 CXF 2 Apache SpamAssassin 2 Storm 2 Apache JSPWiki 2 Apache Archiva 2 Apache Fineract 2 Apache Camel 2 Apache Thrift 2 Apache Tapestry 2 HertzBeat 2 Apache CXF 2 Solr 2 Airflow 1 Dubbo 1 Apache Karaf 1 IoTDB 1 Shiro 1 Apache jclouds 1 Kylin 1 Apache Santuario - XML Security for Java 1 Apache Kylin 1 WSS4J 1 Apache ActiveMQ 1 activemq-artemis 1 Karaf 1 Apache Commons Configuration 1 Apache Mesos 1 Atlas 1 Apache Druid 1 Beam 1 Tomcat 1
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 6.5
    CVE-2020-1958 Public exploit

    Credentials bypass in Apache Druid

    When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filter barrier that determines if a valid LDAP user is allowed to authenticate with Druid. Th…

    Apache Apache Druid org.apache.druid:druid Maven
  • Medium —
    CVE-2019-17564 Public exploit EPSS 37%

    Deserialization of Untrusted Data in Apache Dubbo

    Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue af…

    Apache Apache Dubbo org.apache.dubbo:dubbo-rpc-http-invoker Maven
  • Medium 6.5
    CVE-2020-1937 Public exploit

    SQL Injection in Kylin

    Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries.

    Apache Apache Kylin org.apache.kylin:kylin-server-base Maven
  • Medium 6.1
    CVE-2019-17573 Public exploit

    Reflected Cross-Site Scripting in Apache CXF

    By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack, which allows a malicious actor to inject javascript into the web p…

    Apache CXF org.apache.cxf:cxf org.apache.cxf:apache-cxf Maven
  • Medium 5.5
    CVE-2019-17554 Public exploit EPSS 12%

    Improper Restriction of XML External Entity Reference in Apache Olingo

    The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with content type "application/xml", which trigger the deserialization of entities, can be used to trigger…

    Apache Olingo org.apache.olingo:odata-client-core org.apache.olingo:odata-server-core Maven
  • Medium 6.1
    CVE-2019-10070 Public exploit

    Stored XSS in Apache Atlas

    Apache Atlas versions 0.8.3 and 1.1.0 were found vulnerable to Stored Cross-Site Scripting in the search functionality

    Apache Atlas org.apache.atlas:apache-atlas Maven
  • Medium 6.1
    CVE-2019-0221 Public exploit EPSS 59%

    Cross-site scripting in Apache Tomcat

    The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and…

    Apache Apache Tomcat org.apache.tomcat:tomcat tomcat9 Debian Ubuntu Maven