Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,130

Export CSV
CVE-2021-35936

No Authentication on Logging Server

If remote logging is not used, the worker (in the case of CeleryExecutor) or the scheduler (in the case of LocalExecutor) runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG jobs. This issue affects Apache Airflow < 2.1.2.

CVSS 3.1 · 5.3 Medium EPSS 5.5% KEV · Not listed
Vendors
Apache
Products
Airflow
CVE-2021-35516

Apache Commons Compress 1.6 to 1.20 denial of service vulnerability

When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.

CVSS 3.1 · 7.5 High EPSS 12.4% KEV · Not listed
Vendors
Apache Netapp Oracle and 1 more
Products
Commons Compress Active Iq Unified Manager Oncommand Insight and 23 more
CVE-2021-35515

Apache Commons Compress 1.6 to 1.20 denial of service vulnerability

When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package.

CVSS 3.1 · 7.5 High EPSS 11.6% KEV · Not listed
Vendors
Apache Netapp Oracle and 1 more
Products
Commons Compress Active Iq Unified Manager Oncommand Insight and 25 more
CVE-2021-35474

Dynamic stack buffer overflow in cachekey plugin

Stack-based Buffer Overflow vulnerability in cachekey plugin of Apache Traffic Server. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0 to 8.1.1, 9.0.0 to 9.0.1.

CVSS 3.1 · 9.8 Critical EPSS 2.7% KEV · Not listed
Vendors
Apache Debian
Products
Traffic Server Debian Linux
CVE-2021-34797

Apache Geode project log file redaction of sensitive information vulnerability

Apache Geode versions up to 1.12.4 and 1.13.4 are vulnerable to a log file redaction of sensitive information flaw when using values that begin with characters other than letters or numbers for passwords and security properties with the prefix "sysprop-", "javax.net.ssl", or "security-". This issue is fixed by overhauling the log file redaction in Apache Geode versions 1.12.5, 1.13.5, and 1.14.0.

CVSS 3.1 · 7.5 High EPSS 2.6% KEV · Not listed
Vendors
Apache
Products
Geode
CVE-2021-34538

Apache Hive Security vulnerability in Hive with UDFs

Apache Hive before 3.1.3 "CREATE" and "DROP" function operations does not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. This allowed unauthorized or underprivileged users to drop and recreate UDFs pointing them to new jars that could be potentially malicious.

CVSS 3.1 · 7.5 High EPSS 1.9% KEV · Not listed
Vendors
Apache
Products
Hive
CVE-2021-33900

StartTLS and SASL confidentiality protection bypass

While investigating DIRSTUDIO-1219 it was noticed that configured StartTLS encryption was not applied when any SASL authentication mechanism (DIGEST-MD5, GSSAPI) was used. While investigating DIRSTUDIO-1220 it was noticed that any configured SASL confidentiality layer was not applied. This issue affects Apache Directory Studio version 2.0.0.v20210213-M16 and prior versions.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Directory Studio
CVE-2021-33813

jdom: XXE allows attackers to cause a DoS via a crafted HTTP request

An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request.

CVSS 3.1 · 7.5 High EPSS 19.4% KEV · Not listed
Vendors
Apache Debian Fedoraproject and 3 more
Products
Solr Tika Debian Linux and 7 more
CVE-2021-33580

regex injection leading to DoS

User controlled `request.getHeader("Referer")`, `request.getRequestURL()` and `request.getQueryString()` are used to build and run a regex expression. The attacker doesn't have to use a browser and may send a specially crafted Referer header programmatically. Since the attacker controls the string and the regex pattern he may cause a ReDoS by regex catastrophic backtracking on the server side. This problem has been fixed in Roller 6.0.2.

CVSS 3.1 · 7.5 High EPSS 3.3% KEV · Not listed
Vendors
Apache
Products
Roller
CVE-2021-33192

Display information UI XSS

A vulnerability in the HTML pages of Apache Jena Fuseki allows an attacker to execute arbitrary javascript on certain page views. This issue affects Apache Jena Fuseki from version 2.0.0 to version 4.0.0 (inclusive).

CVSS 3.1 · 6.1 Medium EPSS 2.9% KEV · Not listed
Vendors
Apache
Products
Jena Fuseki
CVE-2021-33191

MiNiFi CPP arbitrary script execution is possible on the agent's host machine through the c2 protocol

From Apache NiFi MiNiFi C++ version 0.5.0 the c2 protocol implements an "agent-update" command which was designed to patch the application binary. This "patching" command defaults to calling a trusted binary, but might be modified to an arbitrary value through a "c2-update" command. Said command is then executed using the same privileges as the application binary. This was addressed in version 0.10.0

CVSS 3.1 · 9.8 Critical EPSS 4.0% KEV · Not listed
Vendors
Apache
Products
Nifi Minifi C\+\+
CVE-2021-33190

Bypass network access control

In Apache APISIX Dashboard version 2.6, we changed the default value of listen host to 0.0.0.0 in order to facilitate users to configure external network access. In the IP allowed list restriction, a risky function was used for the IP acquisition, which made it possible to bypass the network limit. At the same time, the default account and password are fixed.Ultimately these factors lead to the issue of security risks. This issue is fixed in APISIX Dashboard 2.6.1

CVSS 3.1 · 5.3 Medium EPSS 2.7% KEV · Not listed
Vendors
Apache
Products
Apisix Dashboard
CVE-2021-33036

Apache Hadoop Privilege escalation vulnerability

In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary commands as root user. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher.

CVSS 3.1 · 8.8 High EPSS 4.0% KEV · Not listed
Vendors
Apache
Products
Hadoop
CVE-2021-33035

Buffer overflow from a crafted DBF file

Apache OpenOffice opens dBase/DBF documents and shows the contents as spreadsheets. DBF are database files with data organized in fields. When reading DBF data the size of certain fields is not checked: the data is just copied into local variables. A carefully crafted document could overflow the allocated space, leading to the execution of arbitrary code by altering the contents of the program stack. This issue affects Apache OpenOffice up to and including version 4.1.10

CVSS 3.1 · 7.8 High EPSS 50.6% KEV · Not listed
Vendors
Apache
Products
Openoffice
CVE-2021-32792

XSS vulnerability when using OIDCPreservePost On in mod_auth_openidc

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In mod_auth_openidc before version 2.4.9, there is an XSS vulnerability in when using `OIDCPreservePost On`.

CVSS 3.1 · 3.1 Low EPSS 1.5% KEV · Not listed
Vendors
Apache Fedoraproject Openidc and 1 more
Products
Http Server Fedora Mod Auth Openidc and 1 more
CVE-2021-32791

Hardcoded static IV and AAD with a reused key in AES GCM encryption in mod_auth_openidc

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In mod_auth_openidc before version 2.4.9, the AES GCM encryption in mod_auth_openidc uses a static IV and AAD. It is important to fix because this creates a static nonce and since aes-gcm is a stream cipher, this can lead to known cryptographic issues, since the same key is being reused. From 2.4.9 onwards this has been patched to use dynamic values through usage of cjose AES encryption routines.

CVSS 3.1 · 5.9 Medium EPSS 1.5% KEV · Not listed
Vendors
Apache Fedoraproject Openidc and 1 more
Products
Http Server Fedora Mod Auth Openidc and 1 more
CVE-2021-32786

Open Redirect in oidc_validate_redirect_url()

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9, `oidc_validate_redirect_url()` does not parse URLs the same way as most browsers do. As a result, this function can be bypassed and leads to an Open Redirect vulnerability in the logout functionality. This bug has been fixed in version 2.4.9 by replacing any backslash of the URL to redirect with slashes to address a particular breaking change between the different specifications (RFC2396 / RFC3986 and WHATWG). As a workaround, this vulnerability can be mitigated by configuring `mod_auth_openidc` to only allow redirection whose destination matches a given regular expression.

CVSS 3.1 · 4.7 Medium EPSS 2.4% KEV · Not listed
Vendors
Apache Fedoraproject Openidc and 1 more
Products
Http Server Fedora Mod Auth Openidc and 1 more
CVE-2021-32785

Format string bug in the Redis cache implementation

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. When mod_auth_openidc versions prior to 2.4.9 are configured to use an unencrypted Redis cache (`OIDCCacheEncrypt off`, `OIDCSessionType server-cache`, `OIDCCacheType redis`), `mod_auth_openidc` wrongly performed argument interpolation before passing Redis requests to `hiredis`, which would perform it again and lead to an uncontrolled format string bug. Initial assessment shows that this bug does not appear to allow gaining arbitrary code execution, but can reliably provoke a denial of service by repeatedly crashing the Apache workers. This bug has been corrected in version 2.4.9 by performing argument interpolation only once, using the `hiredis` API. As a workaround, this vulnerability can be mitigated by setting `OIDCCacheEncrypt` to `on`, as cache keys are cryptographically hashed before use when this option is enabled.

CVSS 3.1 · 5.3 Medium EPSS 2.7% KEV · Not listed
Vendors
Apache Debian Netapp and 1 more
Products
Http Server Debian Linux Cloud Backup and 1 more
CVE-2021-32609

XSS vulnerability on Explore page

Apache Superset up to and including 1.1 does not sanitize titles correctly on the Explore page. This allows an attacker with Explore access to save a chart with a malicious title, injecting html (including scripts) into the page.

CVSS 3.1 · 5.4 Medium EPSS 1.7% KEV · Not listed
Vendors
Apache
Products
Superset