Filtered by vendor Apache
Subscribe
Total
2238 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2014-3526 | 1 Apache | 1 Wicket | 2019-12-11 | 5.0 MEDIUM | 7.5 HIGH |
| Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive information via vectors involving identifiers for storing page markup for temporary user sessions. | |||||
| CVE-2016-6804 | 2 Apache, Microsoft | 2 Openoffice, Windows | 2019-11-20 | 9.3 HIGH | 7.8 HIGH |
| The Apache OpenOffice installer (versions prior to 4.1.3, including some branded as OpenOffice.org) for Windows contains a defective operation that allows execution of arbitrary code with elevated privileges. This requires that the location in which the installer is run has been previously poisoned by a file that impersonates a dynamic-link library that the installer depends upon. | |||||
| CVE-2009-5004 | 1 Apache | 1 Qpid-cpp | 2019-11-12 | 4.0 MEDIUM | 6.5 MEDIUM |
| qpid-cpp 1.0 crashes when a large message is sent and the Digest-MD5 mechanism with a security layer is in use . | |||||
| CVE-2012-2945 | 1 Apache | 1 Hadoop | 2019-10-31 | 5.0 MEDIUM | 7.5 HIGH |
| Hadoop 1.0.3 contains a symlink vulnerability. | |||||
| CVE-2019-0231 | 1 Apache | 1 Mina | 2019-10-08 | 5.0 MEDIUM | 7.5 HIGH |
| Handling of the close_notify SSL/TLS message does not lead to a connection closure, leading the server to retain the socket opened and to have the client potentially receive clear text messages afterward. Mitigation: 2.0.20 users should migrate to 2.0.21, 2.1.0 users should migrate to 2.1.1. This issue affects: Apache MINA. | |||||
| CVE-2017-7685 | 1 Apache | 1 Openmeetings | 2019-10-03 | 5.0 MEDIUM | 5.3 MEDIUM |
| Apache OpenMeetings 1.0.0 responds to the following insecure HTTP methods: PUT, DELETE, HEAD, and PATCH. | |||||
| CVE-2017-5642 | 1 Apache | 1 Ambari | 2019-10-03 | 7.5 HIGH | 9.8 CRITICAL |
| During installation of Ambari 2.4.0 through 2.4.2, Ambari Server artifacts are not created with proper ACLs. | |||||
| CVE-2018-8028 | 1 Apache | 1 Sentry | 2019-10-03 | 6.5 MEDIUM | 8.8 HIGH |
| An authenticated user can execute ALTER TABLE EXCHANGE PARTITIONS without being authorized by Apache Sentry before 2.0.1. This can allow an attacker unauthorized access to the partitioned data of a Sentry protected table and can allow an attacker to remove data from a Sentry protected table. | |||||
| CVE-2017-7684 | 1 Apache | 1 Openmeetings | 2019-10-03 | 5.0 MEDIUM | 7.5 HIGH |
| Apache OpenMeetings 1.0.0 doesn't check contents of files being uploaded. An attacker can cause a denial of service by uploading multiple large files to the server. | |||||
| CVE-2018-8042 | 1 Apache | 1 Ambari | 2019-10-03 | 4.3 MEDIUM | 8.1 HIGH |
| Apache Ambari, version 2.5.0 to 2.6.2, passwords for Hadoop credential stores are exposed in Ambari Agent informational log messages when the credential store feature is enabled for eligible services. For example, Hive and Oozie. | |||||
| CVE-2018-1331 | 1 Apache | 1 Storm | 2019-10-03 | 6.5 MEDIUM | 8.8 HIGH |
| In Apache Storm 0.10.0 through 0.10.2, 1.0.0 through 1.0.6, 1.1.0 through 1.1.2, and 1.2.0 through 1.2.1, an attacker with access to a secure storm cluster in some cases could execute arbitrary code as a different user. | |||||
| CVE-2017-5635 | 1 Apache | 1 Nifi | 2019-10-03 | 5.0 MEDIUM | 7.5 HIGH |
| In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, if an anonymous user request is replicated to another node, the originating node identity is used rather than the "anonymous" user. | |||||
| CVE-2017-7680 | 1 Apache | 1 Openmeetings | 2019-10-03 | 5.0 MEDIUM | 7.5 HIGH |
| Apache OpenMeetings 1.0.0 has an overly permissive crossdomain.xml file. This allows for flash content to be loaded from untrusted domains. | |||||
| CVE-2017-9804 | 1 Apache | 1 Struts | 2019-10-03 | 5.0 MEDIUM | 7.5 HIGH |
| In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672. | |||||
| CVE-2017-7688 | 1 Apache | 1 Openmeetings | 2019-10-03 | 5.0 MEDIUM | 7.5 HIGH |
| Apache OpenMeetings 1.0.0 updates user password in insecure manner. | |||||
| CVE-2017-7682 | 1 Apache | 1 Openmeetings | 2019-10-03 | 6.4 MEDIUM | 8.2 HIGH |
| Apache OpenMeetings 3.2.0 is vulnerable to parameter manipulation attacks, as a result attacker has access to restricted areas. | |||||
| CVE-2017-7673 | 1 Apache | 1 Openmeetings | 2019-10-03 | 5.0 MEDIUM | 9.8 CRITICAL |
| Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing brute force protection. | |||||
| CVE-2018-11782 | 1 Apache | 1 Subversion | 2019-09-27 | 4.0 MEDIUM | 6.5 MEDIUM |
| In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a well-formed read-only request produces a particular answer. This can lead to disruption for users of the server. | |||||
| CVE-2019-12407 | 1 Apache | 1 Jspwiki | 2019-09-23 | 4.3 MEDIUM | 6.1 MEDIUM |
| On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the remember parameter on some of the JSPs, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. | |||||
| CVE-2019-10090 | 1 Apache | 1 Jspwiki | 2019-09-23 | 4.3 MEDIUM | 6.1 MEDIUM |
| On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the plain editor, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. | |||||