Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,130

Export CSV
CVE-2013-1968

format): Filenames with newline character can lead to revision corruption

Subversion before 1.6.23 and 1.7.x before 1.7.10 allows remote authenticated users to cause a denial of service (FSFS repository corruption) via a newline character in a file name.

CVSS 2.0 · 5.5 Medium EPSS 2.8% KEV · Not listed
Vendors
Apache Canonical Collabnet and 2 more
Products
Subversion Ubuntu Linux Subversion and 2 more
CVE-2013-1966

struts2: remote command execution due to flaw in the includeParams attribute of URL and Anchor tags

Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag.

CVSS 2.0 · 9.3 Critical EPSS 73.7% KEV · Not listed
Vendors
Apache
Products
Struts
CVE-2013-1965

struts2: remote command execution in Showcase app

Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.

CVSS 2.0 · 9.3 Critical EPSS 93.5% KEV · Not listed
Vendors
Apache
Products
Struts Struts2-showcase
CVE-2013-1909

python-qpid: client does not validate qpid server TLS/SSL certificate

The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CVSS 2.0 · 5.8 Medium EPSS 1.8% KEV · Not listed
Vendors
Apache Redhat
Products
Qpid Enterprise Mrg
CVE-2013-1896

httpd: mod_dav DoS (httpd child process crash) via a URI MERGE request with source URI not handled by mod_dav

mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for handling by the mod_dav_svn module, but a certain href attribute in XML data refers to a non-DAV URI.

CVSS 2.0 · 4.3 Medium EPSS 29.5% KEV · Not listed
Vendors
Apache Canonical Opensuse and 1 more
Products
Http Server Ubuntu Linux Opensuse and 8 more
CVE-2013-1884

(mod_dav_svn): DoS (crash) via malformed log REPORT requests

The mod_dav_svn Apache HTTPD server module in Subversion 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (segmentation fault and crash) via a log REPORT request with an invalid limit, which triggers an access of an uninitialized variable.

CVSS 2.0 · 5.0 Medium EPSS 50.5% KEV · Not listed
Vendors
Apache
Products
Subversion
CVE-2013-1880

ActiveMQ: XSS vulnerability in portfolioPublish demo application

Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet in the demo web application in Apache ActiveMQ before 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the refresh parameter to demo/portfolioPublish, a different vulnerability than CVE-2012-6092.

CVSS 2.0 · 4.3 Medium EPSS 6.8% KEV · Not listed
Vendors
Apache Redhat
Products
Activemq Fuse Mq Enterprise
CVE-2013-1879

ActiveMQ: XSS vulnerability in scheduled.jsp

Cross-site scripting (XSS) vulnerability in scheduled.jsp in Apache ActiveMQ 5.8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving the "cron of a message."

CVSS 2.0 · 4.3 Medium EPSS 6.4% KEV · Not listed
Vendors
Apache Redhat
Products
Activemq Fuse Mq Enterprise
CVE-2013-1862

httpd: mod_rewrite allows terminal escape sequences to be written to the log file

mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator.

CVSS 2.0 · 5.1 Medium EPSS 24.9% KEV · Not listed
Vendors
Apache Canonical Opensuse and 2 more
Products
Http Server Ubuntu Linux Opensuse and 9 more
CVE-2013-1849

(mod_dav_svn): DoS (crash) via PROPFIND request made against activity URLs

The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a PROPFIND request for an activity URL.

CVSS 2.0 · 4.3 Medium EPSS 8.8% KEV · Not listed
Vendors
Apache Redhat
Products
Subversion Enterprise Linux
CVE-2013-1847

(mod_dav_svn): DoS (crash) via LOCK requests against a non-existent URL

The mod_dav_svn Apache HTTPD server module in Subversion 1.6.0 through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an anonymous LOCK for a URL that does not exist.

CVSS 2.0 · 5.0 Medium EPSS 51.4% KEV · Not listed
Vendors
Apache Redhat
Products
Subversion Enterprise Linux
CVE-2022-45935

Apache James server: Temporary File Information Disclosure

Usage of temporary files with insecure permissions by the Apache James server allows an attacker with local access to access private user data in transit. Vulnerable components includes the SMTP stack and IMAP APPEND command. This issue affects Apache James server version 3.7.2 and prior versions.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apache
Products
James
CVE-2022-46769

Apache Sling App CMS: XSS in CMS Site Group Detail

An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.2 and prior may allow an authenticated remote attacker to perform a reflected cross-site scripting (XSS) attack in the site group feature. Upgrade to Apache Sling App CMS >= 1.1.4

CVSS 3.1 · 5.4 Medium EPSS 1.5% KEV · Not listed
Vendors
Apache
Products
Sling Cms
CVE-2022-45787

Apache James MIME4J: Temporary File Information Disclosure in MIME4J TempFileStorageProvider

Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvider may lead to information disclosure to other local users. This issue affects Apache James MIME4J version 0.8.8 and prior versions. We recommend users to upgrade to MIME4j version 0.8.9 or later.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apache Redhat
Products
James Jboss Enterprise Application Platform Quarkus and 3 more
CVE-2022-41703

Apache Superset: SQL injection vulnerability in adhoc clauses

A vulnerability in the SQL Alchemy connector of Apache Superset allows an authenticated user with read access to a specific database to add subqueries to the WHERE and HAVING fields referencing tables on the same database that the user should not have access to, despite the user having the feature flag "ALLOW_ADHOC_SUBQUERY" disabled (default value). This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

CVSS 3.1 · 5.4 Medium EPSS 1.2% KEV · Not listed
Vendors
Apache
Products
Superset
CVE-2022-43718

Apache Superset: Cross-Site Scripting vulnerability on upload forms

Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by authenticated users with database connection update permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

CVSS 3.1 · 5.4 Medium EPSS 1.2% KEV · Not listed
Vendors
Apache
Products
Superset
CVE-2022-45438

Apache Superset: Dashboard metadata information leak

When explicitly enabling the feature flag DASHBOARD_CACHE (disabled by default), the system allowed for an unauthenticated user to access dashboard configuration metadata using a REST API Get endpoint. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

CVSS 3.1 · 5.3 Medium EPSS 1.3% KEV · Not listed
Vendors
Apache
Products
Superset
CVE-2022-43721

Apache Superset: Open Redirect Vulnerability

An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

CVSS 3.1 · 5.4 Medium EPSS 1.0% KEV · Not listed
Vendors
Apache
Products
Superset
CVE-2022-43720

Apache Superset: Improper rendering of user input

An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not get properly escaped by the toast message displayed when a user deletes that specific CSS template record. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

CVSS 3.1 · 5.4 Medium EPSS 1.3% KEV · Not listed
Vendors
Apache
Products
Superset
CVE-2022-43719

Apache Superset: Cross Site Request Forgery (CSRF) on accept, request access API

Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Superset