Browse CVEs

CRITICAL 9.8 CVE-2017-5640 It was noticed that a malicious process impersonating an Impala daemon in Apache Impala (incubating) 2.7.0 to 2.8.0 could cause Impala daemons to ski… Impala Mitigation only Fix from $2,3002017-07-10 CRITICAL 9.8 CVE-2017-9791 KEVEPSS 99% The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the Act… Struts Patch available Fix from $2,3002017-07-10 CRITICAL 9.8 CVE-2017-3167EPSS 20% In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication p… HTTP Server 2.2.33 / 2.4.26+ Fix from $2,3002017-06-20 CRITICAL 9.8 CVE-2017-3169EPSS 19% In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party modules call ap_hook_process_con… HTTP Server Mitigation only Fix from $2,3002017-06-20 CRITICAL 9.8 CVE-2017-7679EPSS 32% In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when sending a malicious Content-Typ… HTTP Server 2.2.33 / 2.4.26+ Fix from $2,3002017-06-20 CRITICAL 9.8 CVE-2017-7676 Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '*' wildcard character - like my*test, test*.txt. This can result in u… Ranger after 0.7.0 Fix from $2,3002017-06-14 CRITICAL 9.8 CVE-2017-5645EPSS 90% In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a … Log4j 2.8.2+ Fix from $2,3002017-04-17 CRITICAL 9.8 CVE-2017-5651EPSS 7% In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processin… Tomcat Patch available Fix from $2,3002017-04-17 CRITICAL 9.1 CVE-2017-5648EPSS 13% While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0… Tomcat Mitigation only Fix from $2,3002017-04-17 CRITICAL 9.8 CVE-2016-6808EPSS 18% Buffer overflow in Apache Tomcat Connectors (mod_jk) before 1.2.42. Tomcat Jk Connector 1.2.42+ Fix from $2,3002017-04-12 CRITICAL 9.8 CVE-2016-0779EPSS 10% The EjbObjectInputStream class in Apache TomEE before 1.7.4 and 7.x before 7.0.0-M3 allows remote attackers to execute arbitrary code via a crafted s… Tomee after 1.7.3 Fix from $2,3002017-04-11 CRITICAL 9.8 CVE-2016-6809EPSS 8% Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. The issue exists because Tika invokes JMatIO to d… Nutch after 1.13 Fix from $2,3002017-04-06 CRITICAL 9.8 CVE-2016-8735 KEVEPSS 90% Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M1… Tomcat 6.0.48 / 7.0.73+ Fix from $2,3002017-04-06 CRITICAL 9.8 CVE-2017-5642 During installation of Ambari 2.4.0 through 2.4.2, Ambari Server artifacts are not created with proper ACLs. Ambari Mitigation only Fix from $2,3002017-04-03 CRITICAL 9.8 CVE-2014-3582 In Ambari 1.2.0 through 2.2.2, it may be possible to execute arbitrary system commands on the Ambari Server host while generating SSL certificates fo… Ambari after 2.2.2 Fix from $2,3002017-03-29 CRITICAL 9.8 CVE-2016-6807 Custom commands may be executed on Ambari Agent (2.4.x, before 2.4.2) hosts without authorization, leading to unauthorized access to operations that … Ambari Mitigation only Fix from $2,3002017-03-28 CRITICAL 9.8 CVE-2016-8749EPSS 10% Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks. Camel No fix yet Fix from $2,3002017-03-28 CRITICAL 9.8 CVE-2017-5638 KEVEPSS 100% The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message gene… Struts 2.3.32 / 2.5.10.1+ Fix from $2,3002017-03-11 CRITICAL 9.8 CVE-2017-3159EPSS 6% Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability. De-serializing untrusted data can lead to secur… Camel after 2.18.1 Fix from $2,3002017-03-07 CRITICAL 9.8 CVE-2015-3188EPSS 14% The UI daemon in Apache Storm 0.10.0 before 0.10.0-beta1 allows remote attackers to execute arbitrary code via unspecified vectors. Storm No fix yet Fix from $2,3002017-01-13 CRITICAL 9.8 CVE-2016-1000031EPSS 32% Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution Commons Fileupload after 1.3.2 Fix from $2,3002016-10-25 CRITICAL 9.1 CVE-2015-1832EPSS 11% XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows… Derby Mitigation only Fix from $2,3002016-10-03 CRITICAL 9.8 CVE-2016-5019EPSS 7% CoreResponseStateManager in Apache MyFaces Trinidad 1.0.0 through 1.0.13, 1.2.x before 1.2.15, 2.0.x before 2.0.2, and 2.1.x before 2.1.2 might allow… Myfaces Trinidad 1.0.13 / 1.2.15+ Fix from $2,3002016-10-03 CRITICAL 9.8 CVE-2016-4436EPSS 6% Apache Struts 2 before 2.3.29 and 2.5.x before 2.5.1 allow attackers to have unspecified impact via vectors related to improper action name clean up. Struts Mitigation only Fix from $2,3002016-10-03 CRITICAL 9.8 CVE-2016-4464 The application plugins in Apache CXF Fediz 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against configured… Cxf Fediz Mitigation only Fix from $2,3002016-09-21 CRITICAL 9.8 CVE-2016-4438EPSS 17% The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression. Struts Mitigation only Fix from $2,3002016-07-04 CRITICAL 9.8 CVE-2016-3087EPSS 81% Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to exec… Struts No fix yet Fix from $2,3002016-06-07 CRITICAL 9.8 CVE-2016-4437 KEVEPSS 93% Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code… Aurora 0.18.1 / 1.2.5+ Fix from $2,3002016-06-07 CRITICAL 9.1 CVE-2016-4432EPSS 8% The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication and cons… Qpid Broker J 6.0.3+ Fix from $2,3002016-06-01 CRITICAL 9.8 CVE-2016-3088 KEVEPSS 99% The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT fol… Activemq 5.14.0+ Fix from $2,3002016-06-01