Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,130

Export CSV
CVE-2022-37023

Apache Geode deserialization of untrusted data flaw when using REST API on Java 8 or Java 11

Apache Geode versions prior to 1.15.0 are vulnerable to a deserialization of untrusted data flaw when using REST API on Java 8 or Java 11. Any user wishing to protect against deserialization attacks involving REST APIs should upgrade to Apache Geode 1.15 and follow the documentation for details on enabling "validate-serializable-objects=true" and specifying any user classes that may be serialized/deserialized with "serializable-object-filter". Enabling "validate-serializable-objects" may impact performance.

CVSS 3.1 · 6.5 Medium EPSS 1.8% KEV · Not listed
Vendors
Apache
Products
Geode
CVE-2022-37022

Apache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 11

Apache Geode versions up to 1.12.2 and 1.13.2 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 11. Any user wishing to protect against deserialization attacks involving JMX or RMI should upgrade to Apache Geode 1.15. Use of 1.15 on Java 11 will automatically protect JMX over RMI against deserialization attacks. This should have no impact on performance since it only affects JMX/RMI which Gfsh uses to communicate with the JMX Manager which is hosted on a Locator.

CVSS 3.1 · 8.8 High EPSS 1.5% KEV · Not listed
Vendors
Apache
Products
Geode
CVE-2022-37021

Apache Geode deserialization of untrusted data flaw when using JMX over RMI on Java 8.

Apache Geode versions up to 1.12.5, 1.13.4 and 1.14.0 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 8. Any user still on Java 8 who wishes to protect against deserialization attacks involving JMX or RMI should upgrade to Apache Geode 1.15 and Java 11. If upgrading to Java 11 is not possible, then upgrade to Apache Geode 1.15 and specify "--J=-Dgeode.enableGlobalSerialFilter=true" when starting any Locators or Servers. Follow the documentation for details on specifying any user classes that may be serialized/deserialized with the "serializable-object-filter" configuration option. Using a global serial filter will impact performance.

CVSS 3.1 · 9.8 Critical EPSS 2.6% KEV · Not listed
Vendors
Apache
Products
Geode
CVE-2022-36364

Apache Calcite Avatica JDBC driver `httpclient_impl` connection property can be used as an RCE vector

Apache Calcite Avatica JDBC driver creates HTTP client instances based on class names provided via `httpclient_impl` connection property; however, the driver does not verify if the class implements the expected interface before instantiating it, which can lead to code execution loaded via arbitrary classes and in rare cases remote code execution. To exploit the vulnerability: 1) the attacker needs to have privileges to control JDBC connection parameters; 2) and there should be a vulnerable class (constructor with URL parameter and ability to execute code) in the classpath. From Apache Calcite Avatica 1.22.0 onwards, it will be verified that the class implements the expected interface before invoking its constructor.

CVSS 3.1 · 8.8 High EPSS 3.2% KEV · Not listed
Vendors
Apache
Products
Apache Calcite Avatica
CVE-2022-35741

Apache CloudStack SAML Single Sign-On XXE

Apache CloudStack version 4.5.0 and later has a SAML 2.0 authentication Service Provider plugin which is found to be vulnerable to XML external entity (XXE) injection. This plugin is not enabled by default and the attacker would require that this plugin be enabled to exploit the vulnerability. When the SAML 2.0 plugin is enabled in affected versions of Apache CloudStack could potentially allow the exploitation of XXE vulnerabilities. The SAML 2.0 messages constructed during the authentication flow in Apache CloudStack are XML-based and the XML data is parsed by various standard libraries that are now understood to be vulnerable to XXE injection attacks such as arbitrary file reading, possible denial of service, server-side request forgery (SSRF) on the CloudStack management server.

CVSS 3.1 · 9.8 Critical EPSS 8.0% KEV · Not listed
Vendors
Apache
Products
Cloudstack
CVE-2022-35724

Denial of service while reading data in Avro Rust SDK

It is possible to provide data to be read that leads the reader to loop in cycles endlessly, consuming CPU. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addresses this issue.

CVSS 3.1 · 7.5 High EPSS 1.8% KEV · Not listed
Vendors
Apache
Products
Avro
CVE-2022-34916

Improper Input Validation (JNDI Injection) in JMSMessageConsumer

Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol.

CVSS 3.1 · 9.8 Critical EPSS 3.0% KEV · Not listed
Vendors
Apache
Products
Flume
CVE-2022-34158

User Group Privilege Escalation

A carefully crafted invocation on the Image plugin could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow a group privilege escalation of the attacker's account. Further examination of this issue established that it could also be used to modify the email associated with the attacked account, and then a reset password request from the login page.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed
Vendors
Apache
Products
Jspwiki
CVE-2022-33980

Apache Commons Configuration insecure interpolation defaults

Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.configuration2.interpol.Lookup that performs the interpolation. Starting with version 2.4 and continuing through 2.7, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Configuration 2.8.0, which disables the problematic interpolators by default.

CVSS 3.1 · 9.8 Critical EPSS 44.6% KEV · Not listed
Vendors
Apache Debian Netapp and 1 more
Products
Commons Configuration Debian Linux Snapcenter and 3 more
CVE-2022-33879

Incomplete fix and new regex DoS in StandardsExtractingContentHandler

The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate, new regex DoS in a different regex in the StandardsExtractingContentHandler. These are now fixed in 1.28.4 and 2.4.1.

CVSS 3.1 · 3.3 Low EPSS 2.0% KEV · Not listed
Vendors
Apache
Products
Tika
CVE-2022-33140

Improper Neutralization of Command Elements in Shell User Group Provider

The optional ShellUserGroupProvider in Apache NiFi 1.10.0 to 1.16.2 and Apache NiFi Registry 0.6.0 to 1.16.2 does not neutralize arguments for group resolution commands, allowing injection of operating system commands on Linux and macOS platforms. The ShellUserGroupProvider is not included in the default configuration. Command injection requires ShellUserGroupProvider to be one of the enabled User Group Providers in the Authorizers configuration. Command injection also requires an authenticated user with elevated privileges. Apache NiFi requires an authenticated user with authorization to modify access policies in order to execute the command. Apache NiFi Registry requires an authenticated user with authorization to read user groups in order to execute the command. The resolution removes command formatting based on user-provided arguments.

CVSS 3.1 · 8.8 High EPSS 3.5% KEV · Not listed
Vendors
Apache Apple Linux
Products
Nifi Nifi Registry Macos and 1 more
CVE-2022-32549

log injection in Sling logging

Apache Sling Commons Log <= 5.4.0 and Apache Sling API <= 2.25.0 are vulnerable to log injection. The ability to forge logs may allow an attacker to cover tracks by injecting fake logs and potentially corrupt log files.

CVSS 3.1 · 5.3 Medium EPSS 2.5% KEV · Not listed
Vendors
Apache
Products
Sling Api Sling Commons Log
CVE-2022-32533

Apache Portals Jetspeed XSS, CSRF, SSRF, and XXE issues

Apache Jetspeed-2 does not sufficiently filter untrusted user input by default leading to a number of issues including XSS, CSRF, XXE, and SSRF. Setting the configuration option "xss.filter.post = true" may mitigate these issues. NOTE: Apache Jetspeed is a dormant project of Apache Portals and no updates will be provided for this issue

CVSS 3.1 · 9.8 Critical EPSS 4.2% KEV · Not listed
Vendors
Apache
Products
Jetspeed Portals Jetspeed
CVE-2022-32532

Authentication Bypass Vulnerability

Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPatternMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.

CVSS 3.1 · 9.8 Critical EPSS 25.5% KEV · Not listed
Vendors
Apache
Products
Shiro
CVE-2022-31781

Regular Expression Denial of Service (ReDoS) in ContentType.java. (GHSL-2022-022)

Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles Content Types. Specially crafted Content Types may cause catastrophic backtracking, taking exponential time to complete. Specifically, this is about the regular expression used on the parameter of the org.apache.tapestry5.http.ContentType class. Apache Tapestry 5.8.2 has a fix for this vulnerability. Notice the vulnerability cannot be triggered by web requests in Tapestry code alone. It would only happen if there's some non-Tapestry codepath passing some outside input to the ContentType class constructor.

CVSS 3.1 · 7.5 High EPSS 2.0% KEV · Not listed
Vendors
Apache
Products
Tapestry
CVE-2022-31779

Improper HTTP/2 scheme and method validation

Improper Input Validation vulnerability in HTTP/2 header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.

CVSS 3.1 · 7.5 High EPSS 2.5% KEV · Not listed
Vendors
Apache Debian Fedoraproject
Products
Traffic Server Debian Linux Fedora
CVE-2022-31778

Transfer-Encoding not treated as hop-by-hop

Improper Input Validation vulnerability in handling the Transfer-Encoding header of Apache Traffic Server allows an attacker to poison the cache. This issue affects Apache Traffic Server 8.0.0 to 9.0.2.

CVSS 3.1 · 7.5 High EPSS 2.1% KEV · Not listed
Vendors
Apache Debian
Products
Traffic Server Debian Linux
CVE-2022-30973

Missing fix for CVE-2022-30126 in 1.28.2

We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the 1.28.2 release. In Apache Tika, a regular expression in the StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler. This is fixed in 1.28.3.

CVSS 3.1 · 5.5 Medium EPSS 2.0% KEV · Not listed
Vendors
Apache Redhat
Products
Tika Integration
CVE-2022-30522

mod_sed denial of service

If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort.

CVSS 3.1 · 7.5 High EPSS 89.9% KEV · Not listed
Vendors
Apache Fedoraproject Netapp and 1 more
Products
Http Server Fedora Clustered Data Ontap and 3 more