CVE-2021-40369

XSS vulnerability on Denounce plugin

A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Denounce plugin, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.0 or later.

CVSS 3.1 · 6.1 Medium EPSS 3.4% KEV · Not listed

Vendors

Apache

Products

Jspwiki

CVE-2021-40331

Permissions problem in the Apache Ranger Hive Plugin

An Incorrect Permission Assignment for Critical Resource vulnerability was found in the Apache Ranger Hive Plugin. Any user with SELECT privilege on a database can alter the ownership of the table in Hive when Apache Ranger Hive Plugin is enabled This issue affects Apache Ranger Hive Plugin: from 2.0.0 through 2.3.0. Users are recommended to upgrade to version 2.4.0 or later.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Ranger

CVE-2021-40146

A Remote Code Execution (RCE) vulnerability exists in Apache Any23 YAMLExtractor.java

A Remote Code Execution (RCE) vulnerability was discovered in the Any23 YAMLExtractor.java file and is known to affect Any23 versions < 2.5. RCE vulnerabilities allow a malicious actor to execute any code of their choice on a remote machine over LAN, WAN, or internet. RCE belongs to the broader class of arbitrary code execution (ACE) vulnerabilities.

CVSS 3.1 · 9.8 Critical EPSS 5.7% KEV · Not listed

Vendors

Apache

Products

Any23

CVE-2021-40111

Apache James IMAP parsing Denial Of Service

In Apache James, while fuzzing with Jazzer the IMAP parsing stack, we discover that crafted APPEND and STATUS IMAP command could be used to trigger infinite loops resulting in expensive CPU computations and OutOfMemory exceptions. This can be used for a Denial Of Service attack. The IMAP user needs to be authenticated to exploit this vulnerability. This affected Apache James prior to version 3.6.1. This vulnerability had been patched in Apache James 3.6.1 and higher. We recommend the upgrade.

CVSS 3.1 · 6.5 Medium EPSS 2.2% KEV · Not listed

Vendors

Apache

Products

James

CVE-2021-40110

Apache James IMAP vulnerable to a ReDoS

In Apache James, using Jazzer fuzzer, we identified that an IMAP user can craft IMAP LIST commands to orchestrate a Denial Of Service using a vulnerable Regular expression. This affected Apache James prior to 3.6.1 We recommend upgrading to Apache James 3.6.1 or higher , which enforce the use of RE2J regular expression engine to execute regex in linear time without back-tracking.

CVSS 3.1 · 7.5 High EPSS 3.0% KEV · Not listed

Vendors

Apache

Products

James

CVE-2021-39239

XML External Entity (XXE) vulnerability

A vulnerability in XML processing in Apache Jena, in versions up to 4.1.0, may allow an attacker to execute XML External Entities (XXE), including exposing the contents of local files to a remote server.

CVSS 3.1 · 7.5 High EPSS 4.3% KEV · Not listed

Vendors

Apache

Products

Jena

CVE-2021-39236

Owners of the S3 tokens are not validated

In Apache Ozone before 1.2.0, Authenticated users with valid Ozone S3 credentials can create specific OM requests, impersonating any other user.

CVSS 3.1 · 8.8 High EPSS 2.6% KEV · Not listed

Vendors

Apache

Products

Ozone

CVE-2021-39235

Access mode of block tokens are not enforced

In Apache Ozone before 1.2.0, Ozone Datanode doesn't check the access mode parameter of the block token. Authenticated users with valid READ block token can do any write operation on the same block.

CVSS 3.1 · 6.5 Medium EPSS 1.6% KEV · Not listed

Vendors

Apache

Products

Ozone

CVE-2021-39234

Raw block data can be read bypassing ACL/authorization

In Apache Ozone versions prior to 1.2.0, Authenticated users knowing the ID of an existing block can craft specific request allowing access those blocks, bypassing other security checks like ACL.

CVSS 3.1 · 6.8 Medium EPSS 1.4% KEV · Not listed

Vendors

Apache

Products

Ozone

CVE-2021-39233

Container-related datanode operations can be called without authorization

In Apache Ozone versions prior to 1.2.0, Container related Datanode requests of Ozone Datanode were not properly authorized and can be called by any client.

CVSS 3.1 · 9.1 Critical EPSS 2.4% KEV · Not listed

Vendors

Apache

Products

Ozone

CVE-2021-39232

Missing admin check for SCM related admin commands

In Apache Ozone versions prior to 1.2.0, certain admin related SCM commands can be executed by any authenticated users, not just by admins.

CVSS 3.1 · 8.8 High EPSS 1.7% KEV · Not listed

Vendors

Apache

Products

Ozone

CVE-2021-39231

Missing authentication/authorization on internal RPC endpoints

In Apache Ozone versions prior to 1.2.0, Various internal server-to-server RPC endpoints are available for connections, making it possible for an attacker to download raw data from Datanode and Ozone manager and modify Ratis replication configuration.

CVSS 3.1 · 9.1 Critical EPSS 2.4% KEV · Not listed

Vendors

Apache

Products

Ozone

CVE-2021-38555

An XML external entity (XXE) injection vulnerability exists in Apache Any23 StreamUtils.java

An XML external entity (XXE) injection vulnerability was discovered in the Any23 StreamUtils.java file and is known to affect Any23 versions < 2.5. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access.

CVSS 3.1 · 9.1 Critical EPSS 2.8% KEV · Not listed

Vendors

Apache

Products

Any23

CVE-2021-38542

Apache James vulnerable to STARTTLS command injection (IMAP and POP3)

Apache James prior to release 3.6.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. This can result in Man-in -the-middle command injection attacks, leading potentially to leakage of sensible information.

CVSS 3.1 · 5.9 Medium EPSS 2.3% KEV · Not listed

Vendors

Apache

Products

James

CVE-2021-38540

Apache Airflow: Variable Import endpoint missed authentication check

The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution. This issue affects Apache Airflow >=2.0.0, <2.1.3.

CVSS 3.1 · 9.8 Critical EPSS 80.9% KEV · Not listed

Vendors

Apache

Products

Airflow

CVE-2021-38296

Apache Spark Key Negotiation Vulnerability

Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would allow someone to decrypt plaintext traffic offline. Note that this does not affect security mechanisms controlled by "spark.authenticate.enableSaslEncryption", "spark.io.encryption.enabled", "spark.ssl", "spark.ui.strictTransportSecurity". Update to Apache Spark 3.1.3 or later

CVSS 3.1 · 7.5 High EPSS 1.8% KEV · Not listed

Vendors

Apache Oracle

Products

Spark Financial Services Crime And Compliance Management Studio

CVE-2021-38295

Privilege escalation vulnerability when using HTML attachments

In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML attachment to a document. If a CouchDB admin opens that attachment in a browser, e.g. via the CouchDB admin interface Fauxton, any JavaScript code embedded in that HTML attachment will be executed within the security context of that admin. A similar route is available with the already deprecated _show and _list functionality. This privilege escalation vulnerability allows an attacker to add or remove data in any database or make configuration changes. This issue affected Apache CouchDB prior to 3.1.2

CVSS 3.1 · 7.3 High EPSS 3.7% KEV · Not listed

Vendors

Apache

Products

Couchdb

CVE-2021-38294

Shell Command Injection Vulnerability in Nimbus Thrift Server

A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.

CVSS 3.1 · 9.8 Critical EPSS 83.8% KEV · Not listed

Vendors

Apache

Products

Storm

CVE-2021-38161

Not validating origin TLS certificate

Improper Authentication vulnerability in TLS origin verification of Apache Traffic Server allows for man in the middle attacks. This issue affects Apache Traffic Server 8.0.0 to 8.0.8.

CVSS 3.1 · 8.1 High EPSS 1.9% KEV · Not listed

Vendors

Apache Debian

Products

Traffic Server Debian Linux

CVE-2021-38153

Timing Attack Vulnerability for Apache Kafka Connect and Clients

Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.

CVSS 3.1 · 5.9 Medium EPSS 6.2% KEV · Not listed

Vendors

Apache Oracle Quarkus and 1 more

Products

Kafka Communications Brm - Elastic Charging Engine Communications Cloud Native Core Policy and 12 more