CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Apache : Security Vulnerabilities

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2017-12621 611 2017-09-27 2017-10-10
7.5
None Remote Low Not required Partial Partial Partial
During Jelly (xml) file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the Jelly file, during parser instantiation the parser will attempt to connect to said URL. This could lead to XML External Entity (XXE) attacks in Apache Commons Jelly before 1.0.1.
2 CVE-2017-12616 200 Bypass +Info 2017-09-19 2017-09-27
5.0
None Remote Low Not required Partial None None
When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.
3 CVE-2017-12615 434 Exec Code 2017-09-19 2017-10-04
6.8
None Remote Medium Not required Partial Partial Partial
When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
4 CVE-2017-12612 502 Exec Code 2017-09-13 2017-09-26
7.2
None Local Low Not required Complete Complete Complete
In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket. This makes applications launched programmatically using the launcher API potentially vulnerable to arbitrary code execution by an attacker with access to any user account on the local machine. It does not affect apps run by spark-submit or spark-shell. The attacker would be able to execute code as the user that ran the Spark application. Users are encouraged to update to version 2.2.0 or later.
5 CVE-2017-12611 20 2017-09-20 2017-09-29
7.5
None Remote Low Not required Partial Partial Partial
In Apache Struts 2.0.1 through 2.3.33 and 2.5 through 2.5.10, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.
6 CVE-2017-9805 502 Exec Code 2017-09-15 2017-10-04
6.8
None Remote Medium Not required Partial Partial Partial
The REST Plugin in Apache Struts 2.1.2 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.
7 CVE-2017-9804 399 2017-09-20 2017-10-05
5.0
None Remote Low Not required None None Partial
In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672.
8 CVE-2017-9803 287 2017-09-18 2017-10-04
6.0
None Remote Medium Single system Partial Partial Partial
Solr's Kerberos plugin can be configured to use delegation tokens, which allows an application to reuse the authentication of an end-user or another application. There are two issues with this functionality (when using SecurityAwareZkACLProvider type of ACL provider e.g. SaslZkACLProvider). Firstly, access to the security configuration can be leaked to users other than the solr super user. Secondly, malicious users can exploit this leaked configuration for privilege escalation to further expose/modify private data and/or disrupt operations in the Solr cluster. The vulnerability is fixed from Solr 6.6.1 onwards.
9 CVE-2017-9802 79 XSS Bypass 2017-08-14 2017-09-15
4.3
None Remote Medium Not required None Partial None
The Javascript method Sling.evalString() in Apache Sling Servlets Post before 2.3.22 uses the javascript 'eval' function to parse input strings, which allows for XSS attacks by passing specially crafted input strings.
10 CVE-2017-9801 20 2017-08-07 2017-08-09
5.0
None Remote Low Not required None Partial None
When a call-site passes a subject for an email that contains line-breaks in Apache Commons Email 1.0 through 1.4, the caller can add arbitrary SMTP headers.
11 CVE-2017-9800 20 2017-08-11 2017-09-18
7.5
None Remote Low Not required Partial Partial Partial
A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server (to attack another user of that server's repositories), or by a proxy server. The vulnerability affects all clients, including those that use file://, http://, and plain (untunneled) svn://.
12 CVE-2017-9799 255 2017-08-09 2017-08-24
4.3
None Remote Medium Not required Partial None None
It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user. In the worst case this could lead to secure credentials of the other user being compromised.
13 CVE-2017-9798 416 2017-09-18 2017-09-29
5.0
None Remote Low Not required Partial None None
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.
14 CVE-2017-9797 284 DoS +Info 2017-10-02 2017-10-13
5.8
None Remote Medium Not required Partial None Partial
When an Apache Geode cluster before v1.2.1 is operating in secure mode, an unauthenticated client can enter multi-user authentication mode and send metadata messages. These metadata operations could leak information about application data types. In addition, an attacker could perform a denial of service attack on the cluster.
15 CVE-2017-9794 200 Exec Code +Info 2017-09-29 2017-10-06
4.0
None Remote Low Single system Partial None None
When a cluster is operating in secure mode, a user with read privileges for specific data regions can use the gfsh command line utility to execute queries. In Apache Geode before 1.2.1, the query results may contain data from another user's concurrently executing gfsh query, potentially revealing data that the user is not authorized to view.
16 CVE-2017-9793 20 2017-09-20 2017-10-05
5.0
None Remote Low Not required None None Partial
The REST Plugin in Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted XML payload.
17 CVE-2017-9791 20 Exec Code 2017-07-10 2017-09-27
7.5
None Remote Low Not required Partial Partial Partial
The Struts 1 plugin in Apache Struts 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
18 CVE-2017-9790 19 DoS 2017-09-28 2017-10-11
5.0
None Remote Low Not required None None Partial
When handling a libprocess message wrapped in an HTTP request, libprocess in Apache Mesos before 1.1.3, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.0-dev crashes if the request path is empty, because the parser assumes the request path always starts with '/'. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.
19 CVE-2017-9789 416 2017-07-13 2017-07-21
5.0
None Remote Low Not required None None Partial
When under stress, closing many connections, the HTTP/2 handling code in Apache httpd 2.4.26 would sometimes access memory after it has been freed, resulting in potentially erratic behaviour.
20 CVE-2017-9788 20 DoS +Info 2017-07-13 2017-10-19
6.4
None Remote Low Not required Partial None Partial
In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key with no '=' assignment could reflect the stale value of uninitialized pool memory used by the prior request, leading to leakage of potentially confidential information, and a segfault in other cases resulting in denial of service.
21 CVE-2017-9787 284 2017-07-13 2017-09-27
5.0
None Remote Low Not required None None Partial
When using a Spring AOP functionality to secure Struts actions it is possible to perform a DoS attack. Solution is to upgrade to Apache Struts version 2.5.12 or 2.3.33.
22 CVE-2017-7688 255 2017-07-17 2017-07-19
5.0
None Remote Low Not required Partial None None
Apache OpenMeetings 1.0.0 updates user password in insecure manner.
23 CVE-2017-7687 19 DoS 2017-09-28 2017-10-10
5.0
None Remote Low Not required None None Partial
When handling a decoding failure for a malformed URL path of an HTTP request, libprocess in Apache Mesos before 1.1.3, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.0-dev might crash because the code accidentally calls inappropriate function. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.
24 CVE-2017-7686 200 +Info 2017-06-28 2017-07-06
5.0
None Remote Low Not required Partial None None
Apache Ignite 1.0.0-RC3 to 2.0 uses an update notifier component to update the users about new project releases that include additional functionality, bug fixes and performance improvements. To do that the component communicates to an external PHP server (http://ignite.run) where it needs to send some system properties like Apache Ignite or Java version. Some of the properties might contain user sensitive information.
25 CVE-2017-7685 284 2017-07-17 2017-07-19
5.0
None Remote Low Not required Partial None None
Apache OpenMeetings 1.0.0 responds to the following insecure HTTP methods: PUT, DELETE, HEAD, and PATCH.
26 CVE-2017-7684 399 DoS 2017-07-17 2017-07-19
5.0
None Remote Low Not required None None Partial
Apache OpenMeetings 1.0.0 doesn't check contents of files being uploaded. An attacker can cause a denial of service by uploading multiple large files to the server.
27 CVE-2017-7683 200 +Info 2017-07-17 2017-07-19
5.0
None Remote Low Not required Partial None None
Apache OpenMeetings 1.0.0 displays Tomcat version and detailed error stack trace, which is not secure.
28 CVE-2017-7682 284 2017-07-17 2017-07-19
6.4
None Remote Low Not required Partial Partial None
Apache OpenMeetings 3.2.0 is vulnerable to parameter manipulation attacks, as a result attacker has access to restricted areas.
29 CVE-2017-7681 89 Sql 2017-07-17 2017-07-19
6.5
None Remote Low Single system Partial Partial Partial
Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. This allows authenticated users to modify the structure of the existing query and leak the structure of other queries being made by the application in the back-end.
30 CVE-2017-7680 284 2017-07-17 2017-07-19
5.0
None Remote Low Not required None Partial None
Apache OpenMeetings 1.0.0 has an overly permissive crossdomain.xml file. This allows for flash content to be loaded from untrusted domains.
31 CVE-2017-7679 119 Overflow 2017-06-19 2017-10-19
7.5
None Remote Low Not required Partial Partial Partial
In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Type response header.
32 CVE-2017-7678 79 XSS 2017-07-12 2017-07-26
4.3
None Remote Medium Not required None Partial None
In Apache Spark before 2.2.0, it is possible for an attacker to take advantage of a user's trust in the server to trick them into visiting a link that points to a shared Spark cluster and submits data including MHTML to the Spark master, or history server. This data, which could contain a script, would then be reflected back to the user and could be evaluated and executed by MS Windows-based clients. It is not an attack on Spark itself, but on the user, who may then execute the script inadvertently when viewing elements of the Spark web UIs.
33 CVE-2017-7677 275 2017-06-14 2017-06-19
4.3
None Remote Medium Not required None Partial None
In environments that use external location for hive tables, Hive Authorizer in Apache Ranger before 0.7.1 should be checking RWX permission for create table.
34 CVE-2017-7676 20 2017-06-14 2017-06-19
7.5
None Remote Low Not required Partial Partial Partial
Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '*' wildcard character - like my*test, test*.txt. This can result in unintended behavior.
35 CVE-2017-7675 22 Dir. Trav. Bypass 2017-08-10 2017-08-24
5.0
None Remote Low Not required Partial None None
The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number of security checks that prevented directory traversal attacks. It was therefore possible to bypass security constraints using a specially crafted URL.
36 CVE-2017-7674 345 2017-08-10 2017-08-24
4.3
None Remote Medium Not required None Partial None
The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances.
37 CVE-2017-7673 310 2017-07-17 2017-07-19
5.0
None Remote Low Not required Partial None None
Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing brute force protection.
38 CVE-2017-7672 20 2017-07-13 2017-09-27
4.3
None Remote Medium Not required None None Partial
If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. Solution is to upgrade to Apache Struts version 2.5.12.
39 CVE-2017-7670 399 DoS 2017-07-10 2017-07-26
5.0
None Remote Low Not required None None Partial
The Traffic Router component of the incubating Apache Traffic Control project is vulnerable to a Slowloris style Denial of Service attack. TCP connections made on the configured DNS port will remain in the ESTABLISHED state until the client explicitly closes the connection or Traffic Router is restarted. If connections remain in the ESTABLISHED state indefinitely and accumulate in number to match the size of the thread pool dedicated to processing DNS requests, the thread pool becomes exhausted. Once the thread pool is exhausted, Traffic Router is unable to service any DNS request, regardless of transport protocol.
40 CVE-2017-7669 20 2017-06-04 2017-06-09
8.5
None Remote Medium Single system Complete Complete Complete
In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. When the docker feature is enabled, authenticated users can run commands as root.
41 CVE-2017-7668 20 2017-06-19 2017-10-19
7.5
None Remote Low Not required Partial Partial Partial
The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value.
42 CVE-2017-7667 346 2017-06-12 2017-06-19
5.0
None Remote Low Not required None Partial None
Apache NiFi before 0.7.4 and 1.x before 1.3.0 need to establish the response header telling browsers to only allow framing with the same origin.
43 CVE-2017-7666 79 XSS CSRF 2017-07-17 2017-07-19
6.8
None Remote Medium Not required Partial Partial Partial
Apache OpenMeetings 1.0.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks, XSS attacks, click-jacking, and MIME based attacks.
44 CVE-2017-7665 79 XSS 2017-06-12 2017-06-19
4.3
None Remote Medium Not required None Partial None
In Apache NiFi before 0.7.4 and 1.x before 1.3.0, there are certain user input components in the UI which had been guarding for some forms of XSS issues but were insufficient.
45 CVE-2017-7664 611 2017-07-17 2017-07-19
7.5
None Remote Low Not required Partial Partial Partial
Uploaded XML documents were not correctly validated in Apache OpenMeetings 3.1.0.
46 CVE-2017-7663 79 XSS 2017-07-17 2017-07-19
4.3
None Remote Medium Not required None Partial None
Both global and Room chat are vulnerable to XSS attack in Apache OpenMeetings 3.2.0.
47 CVE-2017-7662 352 CSRF 2017-05-16 2017-07-07
6.8
None Remote Medium Not required Partial Partial Partial
Apache CXF Fediz ships with an OpenId Connect (OIDC) service which has a Client Registration Service, which is a simple web application that allows clients to be created, deleted, etc. A CSRF (Cross Style Request Forgery) style vulnerability has been found in this web application in Apache CXF Fediz prior to 1.4.0 and 1.3.2, meaning that a malicious web application could create new clients, or reset secrets, etc, after the admin user has logged on to the client registration service and the session is still active.
48 CVE-2017-7661 352 CSRF 2017-05-16 2017-07-07
6.8
None Remote Medium Not required Partial Partial Partial
Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF (Cross Style Request Forgery) style vulnerability has been found in the Spring 2, Spring 3, Jetty 8 and Jetty 9 plugins in Apache CXF Fediz prior to 1.4.0, 1.3.2 and 1.2.4.
49 CVE-2017-7660 287 2017-07-07 2017-07-17
5.0
None Remote Low Not required None Partial None
Apache Solr uses a PKI based mechanism to secure inter-node communication when security is enabled. It is possible to create a specially crafted node name that does not exist as part of the cluster and point it to a malicious node. This can trick the nodes in cluster to believe that the malicious node is a member of the cluster. So, if Solr users have enabled BasicAuth authentication mechanism using the BasicAuthPlugin or if the user has implemented a custom Authentication plugin, which does not implement either "HttpClientInterceptorPlugin" or "HttpClientBuilderPlugin", his/her servers are vulnerable to this attack. Users who only use SSL without basic authentication or those who use Kerberos are not affected.
50 CVE-2017-7659 476 2017-07-26 2017-08-08
5.0
None Remote Low Not required None None Partial
A maliciously constructed HTTP/2 request could cause mod_http2 2.4.24, 2.4.25 to dereference a NULL pointer and crash the server process.
Total number of vulnerabilities : 896   Page : 1 (This Page)2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.