Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 1,827

Export CSV
CVE-2022-32533

Apache Portals Jetspeed XSS, CSRF, SSRF, and XXE issues

Apache Jetspeed-2 does not sufficiently filter untrusted user input by default leading to a number of issues including XSS, CSRF, XXE, and SSRF. Setting the configuration option "xss.filter.post = true" may mitigate these issues. NOTE: Apache Jetspeed is a dormant project of Apache Portals and no updates will be provided for this issue

CVSS 3.1 · 9.8 Critical EPSS 4.2% KEV · Not listed
Vendors
Apache
Products
Jetspeed Portals Jetspeed
CVE-2022-32532

Authentication Bypass Vulnerability

Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPatternMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.

CVSS 3.1 · 9.8 Critical EPSS 25.5% KEV · Not listed
Vendors
Apache
Products
Shiro
CVE-2022-31781

Regular Expression Denial of Service (ReDoS) in ContentType.java. (GHSL-2022-022)

Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles Content Types. Specially crafted Content Types may cause catastrophic backtracking, taking exponential time to complete. Specifically, this is about the regular expression used on the parameter of the org.apache.tapestry5.http.ContentType class. Apache Tapestry 5.8.2 has a fix for this vulnerability. Notice the vulnerability cannot be triggered by web requests in Tapestry code alone. It would only happen if there's some non-Tapestry codepath passing some outside input to the ContentType class constructor.

CVSS 3.1 · 7.5 High EPSS 2.0% KEV · Not listed
Vendors
Apache
Products
Tapestry
CVE-2022-31779

Improper HTTP/2 scheme and method validation

Improper Input Validation vulnerability in HTTP/2 header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.

CVSS 3.1 · 7.5 High EPSS 2.5% KEV · Not listed
Vendors
Apache Debian Fedoraproject
Products
Traffic Server Debian Linux Fedora
CVE-2022-31778

Transfer-Encoding not treated as hop-by-hop

Improper Input Validation vulnerability in handling the Transfer-Encoding header of Apache Traffic Server allows an attacker to poison the cache. This issue affects Apache Traffic Server 8.0.0 to 9.0.2.

CVSS 3.1 · 7.5 High EPSS 2.1% KEV · Not listed
Vendors
Apache Debian
Products
Traffic Server Debian Linux
CVE-2022-30522

mod_sed denial of service

If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort.

CVSS 3.1 · 7.5 High EPSS 89.9% KEV · Not listed
Vendors
Apache Fedoraproject Netapp and 1 more
Products
Http Server Fedora Clustered Data Ontap and 3 more
CVE-2022-29266

apisix/jwt-auth may leak secrets in error response

In APache APISIX before 3.13.1, the jwt-auth plugin has a security issue that leaks the user's secret key because the error message returned from the dependency lua-resty-jwt contains sensitive information.

CVSS 3.1 · 7.5 High EPSS 8.1% KEV · Not listed
Vendors
Apache
Products
Apisix
CVE-2022-29265

Improper Restriction of XML External Entity References in Multiple Components

Multiple components in Apache NiFi 0.0.1 to 1.16.0 do not restrict XML External Entity references in the default configuration. The Standard Content Viewer service attempts to resolve XML External Entity references when viewing formatted XML files. The following Processors attempt to resolve XML External Entity references when configured with default property values: - EvaluateXPath - EvaluateXQuery - ValidateXml Apache NiFi flow configurations that include these Processors are vulnerable to malicious XML documents that contain Document Type Declarations with XML External Entity references. The resolution disables Document Type Declarations in the default configuration for these Processors, and disallows XML External Entity resolution in standard services.

CVSS 3.1 · 7.5 High EPSS 2.6% KEV · Not listed
Vendors
Apache
Products
Nifi
CVE-2022-29158

Regular Expression Denial of Service (ReDoS) vulnerability in Apache OFBiz

Apache OFBiz up to version 18.12.05 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles URLs provided by external, unauthenticated users. Upgrade to 18.12.06 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12599

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed
Vendors
Apache
Products
Ofbiz
CVE-2022-29063

Java Deserialization via RMI Connection from the Solr plugin of Apache OFBiz

The Solr plugin of Apache OFBiz is configured by default to automatically make a RMI request on localhost, port 1099. In version 18.12.05 and earlier, by hosting a malicious RMI server on localhost, an attacker may exploit this behavior, at server start-up or on a server restart, in order to run arbitrary code. Upgrade to at least 18.12.06 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12646.

CVSS 3.1 · 9.8 Critical EPSS 5.1% KEV · Not listed
Vendors
Apache
Products
Ofbiz
CVE-2022-28890

Processing external DTDs

A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects Apache Jena version 4.4.0 and prior versions. Apache Jena 4.2.x and 4.3.x do not allow external entities.

CVSS 3.1 · 9.8 Critical EPSS 2.7% KEV · Not listed
Vendors
Apache
Products
Jena
CVE-2022-28220

STARTTLS command injection in Apache JAMES

Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. Fix of CVE-2021-38542, which solved similar problem fron Apache James 3.6.1, is subject to a parser differential and do not take into account concurrent requests.

CVSS 3.1 · 7.5 High EPSS 2.0% KEV · Not listed
Vendors
Apache
Products
James
CVE-2022-28129

Insufficient Validation of HTTP/1.x Headers

Improper Input Validation vulnerability in HTTP/1.1 header parsing of Apache Traffic Server allows an attacker to send invalid headers. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.

CVSS 3.1 · 7.5 High EPSS 2.5% KEV · Not listed
Vendors
Apache Debian Fedoraproject
Products
Traffic Server Debian Linux Fedora
CVE-2022-27479

SQL injection vulnerability in chart data API

Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests. Users should update to 1.4.2 or higher which addresses this issue.

CVSS 3.1 · 9.8 Critical EPSS 2.9% KEV · Not listed
Vendors
Apache
Products
Superset
CVE-2022-26779

Apache Cloudstack insecure random number generation affects project email invitation

Apache CloudStack prior to 4.16.1.0 used insecure random number generation for project invitation tokens. If a project invite is created based only on an email address, a random token is generated. An attacker with knowledge of the project ID and the fact that the invite is sent, could generate time deterministic tokens and brute force attempt to use them prior to the legitimate receiver accepting the invite. This feature is not enabled by default, the attacker is required to know or guess the project ID for the invite in addition to the invitation token, and the attacker would need to be an existing authorized user of CloudStack.

CVSS 3.1 · 7.5 High EPSS 2.9% KEV · Not listed
Vendors
Apache
Products
Cloudstack
CVE-2022-26650

Apache ShenYu (incubating) Regular expression denial of service

In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(), realData) to make judgments, where both parameters are controllable by the user. This can cause an attacker pass in malicious regular expressions and characters causing a resource exhaustion. This issue affects Apache ShenYu (incubating) 2.4.0, 2.4.1 and 2.4.2 and is fixed in 2.4.3.

CVSS 3.1 · 7.5 High EPSS 2.7% KEV · Not listed
Vendors
Apache
Products
Shenyu
CVE-2022-26612

Arbitrary file write in FileUtil#unpackEntries on Windows

In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes. As a result, a TAR entry may create a symlink under the expected extraction directory which points to an external directory. A subsequent TAR entry may extract an arbitrary file into the external directory using the symlink name. This however would be caught by the same targetDirPath check on Unix because of the getCanonicalPath call. However on Windows, getCanonicalPath doesn't resolve symbolic links, which bypasses the check. unpackEntries during TAR extraction follows symbolic links which allows writing outside expected base directory on Windows. This was addressed in Apache Hadoop 3.2.3

CVSS 3.1 · 9.8 Critical EPSS 4.2% KEV · Not listed
Vendors
Apache Microsoft
Products
Hadoop Windows