Apache : Security Vulnerabilities (CVSS score >= 9)

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2022-24706	1188	+Priv	2022-04-26	2022-11-21	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default installation without authenticating and gain admin privileges. The CouchDB documentation has always made recommendations for properly securing an installation, including recommending using a firewall in front of all CouchDB installations.
2	CVE-2022-23307	502		2022-01-18	2022-07-25	9.0	None	Remote	Low	???	Complete	Complete	Complete
CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.
3	CVE-2021-44228	20	Exec Code	2021-12-10	2022-12-09	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
4	CVE-2021-40146		Exec Code	2021-09-11	2021-09-23	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
A Remote Code Execution (RCE) vulnerability was discovered in the Any23 YAMLExtractor.java file and is known to affect Any23 versions < 2.5. RCE vulnerabilities allow a malicious actor to execute any code of their choice on a remote machine over LAN, WAN, or internet. RCE belongs to the broader class of arbitrary code execution (ACE) vulnerabilities.
5	CVE-2021-33036	22	Dir. Trav.	2022-06-15	2022-10-27	9.0	None	Remote	Low	???	Complete	Complete	Complete
In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary commands as root user. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.
6	CVE-2021-30128	502		2021-04-27	2021-09-20	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Apache OFBiz has unsafe deserialization prior to 17.12.07 version
7	CVE-2021-27850	502	Exec Code Bypass	2021-04-15	2021-06-02	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. The vulnerability I have found is a bypass of the fix for CVE-2019-0195. Recap: Before the fix of CVE-2019-0195 it was possible to download arbitrary class files from the classpath by providing a crafted asset file URL. An attacker was able to download the file `AppModule.class` by requesting the URL `http://localhost:8080/assets/something/services/AppModule.class` which contains a HMAC secret key. The fix for that bug was a blacklist filter that checks if the URL ends with `.class`, `.properties` or `.xml`. Bypass: Unfortunately, the blacklist solution can simply be bypassed by appending a `/` at the end of the URL: `http://localhost:8080/assets/something/services/AppModule.class/` The slash is stripped after the blacklist check and the file `AppModule.class` is loaded into the response. This class usually contains the HMAC secret key which is used to sign serialized Java objects. With the knowledge of that key an attacker can sign a Java gadget chain that leads to RCE (e.g. CommonsBeanUtils1 from ysoserial). Solution for this vulnerability: * For Apache Tapestry 5.4.0 to 5.6.1, upgrade to 5.6.2 or later. * For Apache Tapestry 5.7.0, upgrade to 5.7.1 or later.
8	CVE-2021-25646		Exec Code	2021-01-29	2022-07-12	9.0	None	Remote	Low	???	Complete	Complete	Complete
Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possible for an authenticated user to send a specially-crafted request that forces Druid to run user-provided JavaScript code for that request, regardless of server configuration. This can be leveraged to execute code on the target machine with the privileges of the Druid server process.
9	CVE-2020-26217	78	Exec Code	2020-11-16	2022-10-28	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.
10	CVE-2020-17523	287	Bypass	2021-02-03	2022-02-22	9.0	None	Remote	Low	Not required	Partial	Partial	Complete
Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.
11	CVE-2020-13958			2020-11-17	2020-12-01	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
A vulnerability in Apache OpenOffice scripting events allows an attacker to construct documents containing hyperlinks pointing to an executable on the target users file system. These hyperlinks can be triggered unconditionally. In fixed versions no internal protocol may be called from the document event handler and other hyperlinks require a control-click.
12	CVE-2020-13936		Exec Code	2021-03-10	2022-05-12	9.0	None	Remote	Low	???	Complete	Complete	Complete
An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.
13	CVE-2020-13925	78	Exec Code	2020-07-14	2020-07-21	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the server; while the reported API misses necessary input validation, which causes the hackers to have the possibility to execute OS command remotely. Users of all previous versions after 2.3 should upgrade to 3.1.0.
14	CVE-2020-11975	20	Exec Code	2020-06-05	2021-07-21	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process.
15	CVE-2020-9480	306	Exec Code	2020-06-23	2022-04-26	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).
16	CVE-2020-1956	78	Exec Code	2020-05-22	2020-07-15	9.0	None	Remote	Low	???	Complete	Complete	Complete
Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.
17	CVE-2020-1946	78		2021-03-25	2022-07-30	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
In Apache SpamAssassin before 3.4.5, malicious rule configuration (.cf) files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3rd party .cf files from trusted places.
18	CVE-2020-1931	78	Exec Code	2020-01-30	2020-02-02	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious Configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. This issue is less stealthy and attempts to exploit the issue will throw warnings. Thanks to Damian Lukowski at credativ for reporting the issue ethically. With this bug unpatched, exploits can be injected in a number of scenarios though doing so remotely is difficult. In addition to upgrading to SA 3.4.4, we again recommend that users should only use update channels or 3rd party .cf files from trusted places.
19	CVE-2020-1930	78	Exec Code +Priv	2020-01-30	2020-02-02	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
A command execution issue was found in Apache SpamAssassin prior to 3.4.3. Carefully crafted nefarious rule configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. With this bug unpatched, exploits can be injected in a number of scenarios including the same privileges as spamd is run which may be elevated though doing so remotely is difficult. In addition to upgrading to SA 3.4.4, we again recommend that users should only use update channels or 3rd party .cf files from trusted places. If you cannot upgrade, do not use 3rd party rulesets, do not use sa-compile and do not run spamd as an account with elevated privileges.
20	CVE-2019-17556	502		2019-12-04	2019-12-13	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Apache Olingo versions 4.0.0 to 4.6.0 provide the AbstractService class, which is public API, uses ObjectInputStream and doesn't check classes being deserialized. If an attacker can feed malicious metadata to the class, then it may result in running attacker's code in the worse case.
21	CVE-2019-10095	77		2021-09-02	2021-11-30	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
bash command injection vulnerability in Apache Zeppelin allows an attacker to inject system commands into Spark interpreter settings. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions.
22	CVE-2019-5736	78	Exec Code	2019-02-11	2021-12-16	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.
23	CVE-2019-0204		Exec Code	2019-03-25	2022-01-01	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
A specifically crafted Docker image running under the root user can overwrite the init helper binary of the container runtime and/or the command executor in Apache Mesos versions pre-1.4.x, 1.4.0 to 1.4.2, 1.5.0 to 1.5.2, 1.6.0 to 1.6.1, and 1.7.0 to 1.7.1. A malicious actor can therefore gain root-level code execution on the host.
24	CVE-2019-0193	94		2019-08-01	2021-07-30	9.0	None	Remote	Low	???	Complete	Complete	Complete
In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.
25	CVE-2018-11786	269		2018-09-18	2019-10-03	9.0	None	Remote	Low	???	Complete	Complete	Complete
In Apache Karaf prior to 4.2.0 release, if the sshd service in Karaf is left on so an administrator can manage the running instance, any user with rights to the Karaf console can pivot and read/write any file on the file system to which the Karaf process user has access. This can be locked down a bit by using chroot to change the root directory to protect files outside of the Karaf install directory; it can be further locked down by defining a security manager policy that limits file system access to those directories beneath the Karaf home that are necessary for the system to run. However, this still allows anyone with ssh access to the Karaf process to read and write a large number of files as the Karaf process user.
26	CVE-2018-11776	20	Exec Code	2018-08-22	2020-07-15	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.
27	CVE-2018-11769		Exec Code +Priv Bypass	2018-08-08	2019-10-03	9.0	None	Remote	Low	???	Complete	Complete	Complete
CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration settings via the HTTP API, it is possible for a CouchDB administrator user to escalate their privileges to that of the operating system's user under which CouchDB runs, by bypassing the blacklist of configuration settings that are not allowed to be modified via the HTTP API. This privilege escalation effectively allows a CouchDB admin user to gain arbitrary remote code execution, bypassing CVE-2017-12636 and CVE-2018-8007.
28	CVE-2018-11766			2018-11-27	2019-10-03	9.0	None	Remote	Low	???	Complete	Complete	Complete
In Apache Hadoop 2.7.4 to 2.7.6, the security fix for CVE-2016-6811 is incomplete. A user who can escalate to yarn user can possibly run arbitrary commands as root user.
29	CVE-2018-11764	306		2020-10-21	2022-06-03	9.0	None	Remote	Low	???	Complete	Complete	Complete
Web endpoint authentication check is broken in Apache Hadoop 3.0.0-alpha4, 3.0.0-beta1, and 3.0.0. Authenticated users may impersonate any user even if no proxy user is configured.
30	CVE-2018-8029			2019-05-30	2020-10-08	9.0	None	Remote	Low	???	Complete	Complete	Complete
In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.
31	CVE-2018-8007	20	Exec Code +Priv Bypass	2018-07-11	2019-05-13	9.0	None	Remote	Low	???	Complete	Complete	Complete
Apache CouchDB administrative users can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration settings via the HTTP API, it is possible for a CouchDB administrator user to escalate their privileges to that of the operating system's user that CouchDB runs under, by bypassing the blacklist of configuration settings that are not allowed to be modified via the HTTP API. This privilege escalation effectively allows an existing CouchDB admin user to gain arbitrary remote code execution, bypassing already disclosed CVE-2017-12636. Mitigation: All users should upgrade to CouchDB releases 1.7.2 or 2.1.2.
32	CVE-2018-1335			2018-04-25	2019-10-03	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.
33	CVE-2017-12636	78	Exec Code	2017-11-14	2019-05-13	9.0	None	Remote	Low	???	Complete	Complete	Complete
CouchDB administrative users can configure the database server via HTTP(S). Some of the configuration options include paths for operating system-level binaries that are subsequently launched by CouchDB. This allows an admin user in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to execute arbitrary shell commands as the CouchDB user, including downloading and executing scripts from the public internet.
34	CVE-2017-12635	269	Exec Code	2017-11-14	2019-10-03	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keys for 'roles' used for access control within the database, including the special case '_admin' role, that denotes administrative users. In combination with CVE-2017-12636 (Remote Code Execution), this can be used to give non-admin users access to arbitrary shell commands on the server as the database system user. The JSON parser differences result in behaviour that if two 'roles' keys are available in the JSON, the second one will be used for authorising the document write, but the first 'roles' key is used for subsequent authorization for the newly created user. By design, users can not assign themselves roles. The vulnerability allows non-admin users to give themselves admin privileges.
35	CVE-2017-5638	20	Exec Code	2017-03-11	2021-02-24	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or Content-Length HTTP header, as exploited in the wild in March 2017 with a Content-Type header containing a #cmd= string.
36	CVE-2016-8744	502	Exec Code	2017-09-13	2017-09-29	9.0	None	Remote	Low	???	Complete	Complete	Complete
Apache Brooklyn uses the SnakeYAML library for parsing YAML inputs. SnakeYAML allows the use of YAML tags to indicate that SnakeYAML should unmarshal data to a Java type. In the default configuration in Brooklyn before 0.10.0, SnakeYAML will allow unmarshalling to any Java type available on the classpath. This could provide an authenticated user with a means to cause the JVM running Brooklyn to load and run Java code without detection by Brooklyn. Such code would have the privileges of the Java process running Brooklyn, including the ability to open files and network connections, and execute system commands. There is known to be a proof-of-concept exploit using this vulnerability.
37	CVE-2016-6811	264		2017-04-11	2018-05-10	9.0	None	Remote	Low	???	Complete	Complete	Complete
In Apache Hadoop 2.x before 2.7.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.
38	CVE-2016-5397	77		2018-02-12	2020-06-04	9.0	None	Remote	Low	???	Complete	Complete	Complete
The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0.
39	CVE-2016-5002	611		2017-10-27	2018-12-05	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
XML external entity (XXE) vulnerability in the Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted DTD.
40	CVE-2016-4461	20	Exec Code	2017-10-16	2019-05-01	9.0	None	Remote	Low	???	Complete	Complete	Complete
Apache Struts 2.x before 2.3.29 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced double OGNL evaluation. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-0785.
41	CVE-2016-3082	20	Exec Code	2016-04-26	2016-11-28	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute arbitrary code via the stylesheet location parameter.
42	CVE-2016-3081	77	Exec Code	2016-04-26	2019-08-12	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
43	CVE-2016-2099			2016-05-13	2018-10-30	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Use-after-free vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 3.1.3 and earlier allows context-dependent attackers to have unspecified impact via an invalid character in an XML document.
44	CVE-2016-0785	20	Exec Code	2016-04-12	2019-08-23	9.0	None	Remote	Low	???	Complete	Complete	Complete
Apache Struts 2.x before 2.3.28 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced double OGNL evaluation.
45	CVE-2016-0709	22	Exec Code Dir. Trav.	2016-04-11	2016-04-20	9.0	None	Remote	Low	???	Complete	Complete	Complete
Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote authenticated administrators to write to arbitrary files, and consequently execute arbitrary code, via a .. (dot dot) in a ZIP archive entry, as demonstrated by "../../webapps/x.jsp."
46	CVE-2015-7611	78	Exec Code	2016-06-07	2018-10-09	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspecified vectors.
47	CVE-2015-5349	77	Exec Code	2016-04-11	2021-08-09	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
The CSV export in Apache LDAP Studio and Apache Directory Studio before 2.0.0-M10 does not properly escape field values, which might allow attackers to execute arbitrary commands by leveraging a crafted LDAP entry that is interpreted as a formula when imported into a spreadsheet.
48	CVE-2015-5259	119	Exec Code Overflow	2016-01-08	2017-07-01	9.0	None	Remote	Low	Not required	Partial	Partial	Complete
Integer overflow in the read_string function in libsvn_ra_svn/marshal.c in Apache Subversion 1.9.x before 1.9.3 allows remote attackers to execute arbitrary code via an svn:// protocol string, which triggers a heap-based buffer overflow and an out-of-bounds read.
49	CVE-2015-5206			2017-09-13	2017-09-21	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server before 5.3.x before 5.3.2 has unknown impact and attack vectors, a different vulnerability than CVE-2015-5168.
50	CVE-2015-5168			2017-09-13	2017-09-21	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.2 has unknown impact and attack vectors, a different vulnerability than CVE-2015-5206.

Total number of vulnerabilities : 93 Page : 1 (This Page)2