CVE-2022-22728

libapreq2 multipart form parse memory corruption

A flaw in Apache libapreq2 versions 2.16 and earlier could cause a buffer overflow while processing multipart form uploads. A remote attacker could send a request causing a process crash which could lead to a denial of service attack.

CVSS 3.1 · 7.5 High EPSS 6.3% KEV · Not listed

Vendors

Apache Debian Fedoraproject

Products

Libapreq2 Debian Linux Fedora

CVE-2022-22721

core: Possible buffer overflow with very large or unlimited LimitXMLRequestBody

If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes. This issue affects Apache HTTP Server 2.4.52 and earlier.

CVSS 3.1 · 9.1 Critical EPSS 41.9% KEV · Not listed

Vendors

Apache Apple Debian and 3 more

Products

Http Server Mac Os X Macos and 8 more

CVE-2022-22720

HTTP request smuggling vulnerability in Apache HTTP Server 2.4.52 and earlier

Apache HTTP Server 2.4.52 and earlier fails to close inbound connection when errors are encountered discarding the request body, exposing the server to HTTP Request Smuggling

CVSS 3.1 · 9.8 Critical EPSS 28.2% KEV · Not listed

Vendors

Apache Apple Debian and 3 more

Products

Http Server Mac Os X Macos and 13 more

CVE-2022-22719

mod_lua Use of uninitialized value of in r:parsebody

A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. This issue affects Apache HTTP Server 2.4.52 and earlier.

CVSS 3.1 · 7.5 High EPSS 69.8% KEV · Not listed

Vendors

Apache Apple Debian and 3 more

Products

Http Server Mac Os X Macos and 6 more

CVE-2021-45458

Hardcoded credentials

Apache Kylin provides encryption classes PasswordPlaceholderConfigurer to help users encrypt their passwords. In the encryption algorithm used by this encryption class, the cipher is initialized with a hardcoded key and IV. If users use class PasswordPlaceholderConfigurer to encrypt their password and configure it into kylin's configuration file, there is a risk that the password may be decrypted. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions.

CVSS 3.1 · 7.5 High EPSS 2.1% KEV · Not listed

Vendors

Apache

Products

Kylin

CVE-2021-45457

Overly broad CORS configuration

In Apache Kylin, Cross-origin requests with credentials are allowed to be sent from any origin. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions.

CVSS 3.1 · 7.5 High EPSS 2.5% KEV · Not listed

Vendors

Apache

Products

Kylin

CVE-2021-45456

Command injection

Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass the check and perform the following steps, resulting in a command injection vulnerability. This issue affects Apache Kylin 4.0.0.

CVSS 3.1 · 9.8 Critical EPSS 88.9% KEV · Not listed

Vendors

Apache

Products

Kylin

CVE-2021-45232

security vulnerability on unauthorized access.

In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework `droplet` on the basis of framework `gin`, all APIs and authentication middleware are developed based on framework `droplet`, but some API directly use the interface of framework `gin` thus bypassing the authentication.

CVSS 3.1 · 9.8 Critical EPSS 86.3% KEV · Not listed

Vendors

Apache

Products

Apisix Dashboard

CVE-2021-45029

Apache ShenYu 2.4.1 Groovy Code Injection & SpEL Injection

Groovy Code Injection & SpEL Injection which lead to Remote Code Execution. This issue affected Apache ShenYu 2.4.0 and 2.4.1.

CVSS 3.1 · 9.8 Critical EPSS 6.0% KEV · Not listed

Vendors

Apache

Products

Shenyu

CVE-2021-44759

Improper authentication vulnerability in TLS origin verification

Improper Authentication vulnerability in TLS origin validation of Apache Traffic Server allows an attacker to create a man in the middle attack. This issue affects Apache Traffic Server 8.0.0 to 8.1.0.

CVSS 3.1 · 8.1 High EPSS 1.6% KEV · Not listed

Vendors

Apache Debian

Products

Traffic Server Debian Linux

CVE-2021-44549

SMTPS server hostname not checked when making TLS connection to SMTPS server

Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS. To reduce the risk of "man in the middle" attacks additional server identity checks must be performed when accessing mail servers. For compatibility reasons these additional checks are disabled by default in JavaMail/Jakarta Mail. The SimpleMailService in Apache Sling Commons Messaging Mail 1.0 lacks an option to enable these checks for the shared mail session. A user could enable these checks nevertheless by accessing the session via the message created by SimpleMessageBuilder and setting the property mail.smtps.ssl.checkserveridentity to true. Apache Sling Commons Messaging Mail 2.0 adds support for enabling server identity checks and these checks are enabled by default. - https://javaee.github.io/javamail/docs/SSLNOTES.txt - https://javaee.github.io/javamail/docs/api/com/sun/mail/smtp/package-summary.html - https://github.com/eclipse-ee4j/mail/issues/429

CVSS 3.1 · 7.4 High EPSS 2.1% KEV · Not listed

Vendors

Apache Redhat

Products

Sling Commons Messaging Mail Ocp Tools Quarkus

CVE-2021-44548

Apache Solr information disclosure vulnerability through DataImportHandler

An Improper Input Validation vulnerability in DataImportHandler of Apache Solr allows an attacker to provide a Windows UNC path resulting in an SMB network call being made from the Solr host to another host on the network. If the attacker has wider access to the network, this may lead to SMB attacks, which may result in: * The exfiltration of sensitive data such as OS user hashes (NTLM/LM hashes), * In case of misconfigured systems, SMB Relay Attacks which can lead to user impersonation on SMB Shares or, in a worse-case scenario, Remote Code Execution This issue affects all Apache Solr versions prior to 8.11.1. This issue only affects Windows.

CVSS 3.1 · 9.8 Critical EPSS 5.2% KEV · Not listed

Vendors

Apache Microsoft

Products

Solr Windows

CVE-2021-44521

Remote code execution for scripted UDFs

When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need to have enough permissions to create user defined functions in the cluster to be able to exploit this. Note that this configuration is documented as unsafe, and will continue to be considered unsafe after this CVE.

CVSS 3.1 · 9.1 Critical EPSS 58.9% KEV · Not listed

Vendors

Apache

Products

Cassandra

CVE-2021-44224

Possible NULL dereference or SSRF in forward proxy configurations in Apache HTTP Server 2.4.51 and earlier

A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server Side Request Forgery). This issue affects Apache HTTP Server 2.4.7 up to 2.4.51 (included).

CVSS 3.1 · 8.2 High EPSS 82.3% KEV · Not listed

Vendors

Apache Apple Debian and 4 more

Products

Http Server Mac Os X Macos and 12 more

CVE-2021-44140

Arbitrary file deletion on logout

Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on logout, given that those files are reachable to the user running the JSPWiki instance. Apache JSPWiki users should upgrade to 2.11.0 or later.

CVSS 3.1 · 9.1 Critical EPSS 6.4% KEV · Not listed

Vendors

Apache

Products

Jspwiki

CVE-2021-44040

HTTP request line fuzzing attacks

Improper Input Validation vulnerability in request line parsing of Apache Traffic Server allows an attacker to send invalid requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.3 and 9.0.0 to 9.1.1.

CVSS 3.1 · 7.5 High EPSS 2.0% KEV · Not listed

Vendors

Apache Debian

Products

Traffic Server Debian Linux

CVE-2021-43999

Improper validation of SAML responses

Apache Guacamole 1.2.0 and 1.3.0 do not properly validate responses received from a SAML identity provider. If SAML support is enabled, this may allow a malicious user to assume the identity of another Guacamole user.

CVSS 3.1 · 8.8 High EPSS 1.8% KEV · Not listed

Vendors

Apache

Products

Guacamole

CVE-2021-43557

Path traversal in request_uri variable

The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification. The $request_uri is the full original request URI without normalization. This makes it possible to construct a URI to bypass the block list on some occasions. For instance, when the block list contains "^/internal/", a URI like `//internal/` can be used to bypass it. Some other plugins also have the same issue. And it may affect the developer's custom plugin.

CVSS 3.1 · 7.5 High EPSS 13.0% KEV · Not listed

Vendors

Apache

Products

Apisix

CVE-2021-43350

LDAP filter injection vulnerability in Traffic Ops

An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST /login endpoint of any API version to inject unsanitized content into the LDAP filter.

CVSS 3.1 · 9.8 Critical EPSS 4.8% KEV · Not listed

Vendors

Apache

Products

Traffic Control

CVE-2021-43297

Dubbo Hessian cause RCE when parse error

A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protocol, during Hessian catch unexpected exceptions, Hessian will log out some imformation for users, which may cause remote command execution. This issue affects Apache Dubbo Apache Dubbo 2.6.x versions prior to 2.6.12; Apache Dubbo 2.7.x versions prior to 2.7.15; Apache Dubbo 3.0.x versions prior to 3.0.5.

CVSS 3.1 · 9.8 Critical EPSS 17.4% KEV · Not listed

Vendors

Apache

Products

Dubbo