Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,130

Export CSV
CVE-2021-45229

Apache Airflow: Reflected XSS via Origin Query Argument in URL

It was discovered that the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument. This issue affects Apache Airflow versions 2.2.3 and below.

CVSS 3.1 · 6.1 Medium EPSS 2.6% KEV · Not listed
Vendors
Apache
Products
Airflow
CVE-2021-45029

Apache ShenYu 2.4.1 Groovy Code Injection & SpEL Injection

Groovy Code Injection & SpEL Injection which lead to Remote Code Execution. This issue affected Apache ShenYu 2.4.0 and 2.4.1.

CVSS 3.1 · 9.8 Critical EPSS 6.0% KEV · Not listed
Vendors
Apache
Products
Shenyu
CVE-2021-44791

Reflected XSS on certain HTTP endpoints

In Apache Druid 0.22.1 and earlier, certain specially-crafted links result in unescaped URL parameters being sent back in HTML responses. This makes it possible to execute reflected XSS attacks.

CVSS 3.1 · 6.1 Medium EPSS 2.3% KEV · Not listed
Vendors
Apache
Products
Druid
CVE-2021-44759

Improper authentication vulnerability in TLS origin verification

Improper Authentication vulnerability in TLS origin validation of Apache Traffic Server allows an attacker to create a man in the middle attack. This issue affects Apache Traffic Server 8.0.0 to 8.1.0.

CVSS 3.1 · 8.1 High EPSS 1.6% KEV · Not listed
Vendors
Apache Debian
Products
Traffic Server Debian Linux
CVE-2021-44549

SMTPS server hostname not checked when making TLS connection to SMTPS server

Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS. To reduce the risk of "man in the middle" attacks additional server identity checks must be performed when accessing mail servers. For compatibility reasons these additional checks are disabled by default in JavaMail/Jakarta Mail. The SimpleMailService in Apache Sling Commons Messaging Mail 1.0 lacks an option to enable these checks for the shared mail session. A user could enable these checks nevertheless by accessing the session via the message created by SimpleMessageBuilder and setting the property mail.smtps.ssl.checkserveridentity to true. Apache Sling Commons Messaging Mail 2.0 adds support for enabling server identity checks and these checks are enabled by default. - https://javaee.github.io/javamail/docs/SSLNOTES.txt - https://javaee.github.io/javamail/docs/api/com/sun/mail/smtp/package-summary.html - https://github.com/eclipse-ee4j/mail/issues/429

CVSS 3.1 · 7.4 High EPSS 2.1% KEV · Not listed
Vendors
Apache Redhat
Products
Sling Commons Messaging Mail Ocp Tools Quarkus
CVE-2021-44548

Apache Solr information disclosure vulnerability through DataImportHandler

An Improper Input Validation vulnerability in DataImportHandler of Apache Solr allows an attacker to provide a Windows UNC path resulting in an SMB network call being made from the Solr host to another host on the network. If the attacker has wider access to the network, this may lead to SMB attacks, which may result in: * The exfiltration of sensitive data such as OS user hashes (NTLM/LM hashes), * In case of misconfigured systems, SMB Relay Attacks which can lead to user impersonation on SMB Shares or, in a worse-case scenario, Remote Code Execution This issue affects all Apache Solr versions prior to 8.11.1. This issue only affects Windows.

CVSS 3.1 · 9.8 Critical EPSS 5.2% KEV · Not listed
Vendors
Apache Microsoft
Products
Solr Windows
CVE-2021-44521

Remote code execution for scripted UDFs

When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need to have enough permissions to create user defined functions in the cluster to be able to exploit this. Note that this configuration is documented as unsafe, and will continue to be considered unsafe after this CVE.

CVSS 3.1 · 9.1 Critical EPSS 58.9% KEV · Not listed
Vendors
Apache
Products
Cassandra
CVE-2021-44451

API sensitive information leak

Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated users. This information could be accessed in a non-trivial way. Users should upgrade to Apache Superset 1.4.0 or higher.

CVSS 3.1 · 6.5 Medium EPSS 7.9% KEV · Not listed
Vendors
Apache
Products
Superset
CVE-2021-44224

Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier

A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).

CVSS 3.1 · 8.2 High EPSS 82.3% KEV · Not listed
Vendors
Apache Apple Debian and 4 more
Products
Http Server Mac Os X Macos and 12 more
CVE-2021-44145

Apache NiFi information disclosure by XXE

In the TransformXML processor of Apache NiFi before 1.15.1 an authenticated user could configure an XSLT file which, if it included malicious external entity calls, may reveal sensitive information.

CVSS 3.1 · 6.5 Medium EPSS 1.8% KEV · Not listed
Vendors
Apache
Products
Nifi
CVE-2021-44140

Arbitrary file deletion on logout

Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on logout, given that those files are reachable to the user running the JSPWiki instance. Apache JSPWiki users should upgrade to 2.11.0 or later.

CVSS 3.1 · 9.1 Critical EPSS 6.4% KEV · Not listed
Vendors
Apache
Products
Jspwiki
CVE-2021-44040

HTTP request line fuzzing attacks

Improper Input Validation vulnerability in request line parsing of Apache Traffic Server allows an attacker to send invalid requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.3 and 9.0.0 to 9.1.1.

CVSS 3.1 · 7.5 High EPSS 2.0% KEV · Not listed
Vendors
Apache Debian
Products
Traffic Server Debian Linux
CVE-2021-43999

Improper validation of SAML responses

Apache Guacamole 1.2.0 and 1.3.0 do not properly validate responses received from a SAML identity provider. If SAML support is enabled, this may allow a malicious user to assume the identity of another Guacamole user.

CVSS 3.1 · 8.8 High EPSS 1.8% KEV · Not listed
Vendors
Apache
Products
Guacamole
CVE-2021-43557

Path traversal in request_uri variable

The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification. The $request_uri is the full original request URI without normalization. This makes it possible to construct a URI to bypass the block list on some occasions. For instance, when the block list contains "^/internal/", a URI like `//internal/` can be used to bypass it. Some other plugins also have the same issue. And it may affect the developer's custom plugin.

CVSS 3.1 · 7.5 High EPSS 13.0% KEV · Not listed
Vendors
Apache
Products
Apisix
CVE-2021-43410

airavata-django-portal allows CRLF log injection because of the lack of escaping in the log statements

Apache Airavata Django Portal allows CRLF log injection because of lack of escaping log statements. In particular, some HTTP request parameters are logged without first being escaped. Versions affected: master branch before commit 3c5d8c7 [1] of airavata-django-portal [1] https://github.com/apache/airavata-django-portal/commit/3c5d8c72bfc3eb0af8693a655a5d60f9273f8170

CVSS 3.1 · 5.3 Medium EPSS 2.5% KEV · Not listed
Vendors
Apache
Products
Airavata Django Portal
CVE-2021-43350

LDAP filter injection vulnerability in Traffic Ops

An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST /login endpoint of any API version to inject unsanitized content into the LDAP filter.

CVSS 3.1 · 9.8 Critical EPSS 4.8% KEV · Not listed
Vendors
Apache
Products
Traffic Control
CVE-2021-43297

Dubbo Hessian cause RCE when parse error

A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protocol, during Hessian catch unexpected exceptions, Hessian will log out some imformation for users, which may cause remote command execution. This issue affects Apache Dubbo Apache Dubbo 2.6.x versions prior to 2.6.12; Apache Dubbo 2.7.x versions prior to 2.7.15; Apache Dubbo 3.0.x versions prior to 3.0.5.

CVSS 3.1 · 9.8 Critical EPSS 17.4% KEV · Not listed
Vendors
Apache
Products
Dubbo
CVE-2021-43083

Apache PLC4X 0.9.0 Buffer overflow in PLC4C via crafted server response

Apache PLC4X - PLC4C (Only the C language implementation was effected) was vulnerable to an unsigned integer underflow flaw inside the tcp transport. Users should update to 0.9.1, which addresses this issue. However, in order to exploit this vulnerability, a user would have to actively connect to a mallicious device which could send a response with invalid content. Currently we consider the probability of this being exploited as quite minimal, however this could change in the future, especially with the industrial networks growing more and more together.

CVSS 3.1 · 8.8 High EPSS 2.0% KEV · Not listed
Vendors
Apache
Products
Plc4x
CVE-2021-43082

heap-buffer-overflow with stats-over-http plugin

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the stats-over-http plugin of Apache Traffic Server allows an attacker to overwrite memory. This issue affects Apache Traffic Server 9.1.0.

CVSS 3.1 · 9.8 Critical EPSS 2.4% KEV · Not listed
Vendors
Apache
Products
Traffic Server
CVE-2021-43045

Possible DOS vulnerabilities in C# Avro SDK

A vulnerability in the .NET SDK of Apache Avro allows an attacker to allocate excessive resources, potentially causing a denial-of-service attack. This issue affects .NET applications using Apache Avro version 1.10.2 and prior versions. Users should update to version 1.11.0 which addresses this issue.

CVSS 3.1 · 7.5 High EPSS 3.1% KEV · Not listed
Vendors
Apache
Products
Avro