Browse CVEs

HIGH 8.8 CVE-2013-0267 The Privileges portion of the web GUI and the XMLRPC API in Apache VCL 2.3.x before 2.3.2, 2.2.x before 2.2.2 and 2.1 allow remote authenticated user… Vcl 2.3.2+ Fix from $1,9502018-02-21 MEDIUM 6.5 CVE-2017-15699 A Denial of Service vulnerability was found in Apache Qpid Dispatch Router versions 0.7.0 and 0.8.0. To exploit this vulnerability, a remote user mus… Qpid Dispatch Patch available Fix from $1,6002018-02-13 MEDIUM 5.9 CVE-2018-1298 A Denial of Service vulnerability was found in Apache Qpid Broker-J 7.0.0 in functionality for authentication of connections for AMQP protocols 0-8, … Qpid Broker J Mitigation only Fix from $1,6002018-02-09 CRITICAL 9.8 CVE-2017-15697 A malicious X-ProxyContextPath or X-Forwarded-Context header containing external resources or embedded code could cause remote code execution. The fi… Nifi after 1.4.0 Fix from $2,3002018-01-23 HIGH 7.5 CVE-2017-12632 A malicious host header in an incoming HTTP request could cause NiFi to load resources from an external server. The fix to sanitize host headers and … Nifi after 1.4.0 Fix from $1,9502018-01-23 MEDIUM 6.2 CVE-2017-15707 In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack using malici… Struts after 2.5.14 Fix from $1,6002017-12-01 MEDIUM 5.5 CVE-2014-0219 Apache Karaf before 4.0.10 enables a shutdown port on the loopback interface, which allows local users to cause a denial of service (shutdown) by sen… Karaf 4.0.10+ Fix from $1,6002017-11-15 CRITICAL 9.8 CVE-2013-4366 http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null, which allows a… Httpclient Patch available Fix from $2,3002017-10-30 HIGH 7.5 CVE-2014-0072EPSS 8% ios/CDVFileTransfer.m in the Apache Cordova File-Transfer standalone plugin (org.apache.cordova.file-transfer) before 0.4.2 for iOS and the File-Tran… Cordova File Transfer after 2.9.0 Fix from $1,9502017-10-30 MEDIUM 5.3 CVE-2009-1197 Apache jUDDI before 2.0 allows attackers to spoof entries in log files via vectors related to error logging of keys from uddiget.jsp. Juddi Mitigation only Fix from $1,6002017-10-30 HIGH 8.8 CVE-2016-3090EPSS 6% The TextParseUtil.translateVariables method in Apache Struts 2.x before 2.3.20 allows remote attackers to execute arbitrary code via a crafted OGNL e… Struts Mitigation only Fix from $1,9502017-10-30 MEDIUM 5.3 CVE-2015-1835EPSS 6% Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in config.xml, allows remote attackers to … Cordova after 3.7.1 Fix from $1,6002017-10-27 HIGH 8.8 CVE-2016-4461EPSS 8% Apache Struts 2.x before 2.3.29 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced double OGNL eva… Struts 2.3.29+ Fix from $1,9502017-10-16 CRITICAL 9.8 CVE-2017-12611EPSS 87% In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can … Struts Patch available Fix from $2,3002017-09-20 HIGH 7.5 CVE-2017-9793EPSS 9% The REST Plugin in Apache Struts 2.1.x, 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable and allo… Struts Patch available Fix from $1,9502017-09-20 HIGH 7.5 CVE-2017-9804EPSS 8% In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is us… Struts Patch available Fix from $1,9502017-09-20 MEDIUM 5.9 CVE-2016-8738 In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the built-in URLValidator is used, it is possible to … Struts Patch available Fix from $1,6002017-09-20 HIGH 8.8 CVE-2016-4462 By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template Engine that ar… Ofbiz Mitigation only Fix from $1,9502017-08-30 HIGH 7.5 CVE-2015-5209EPSS 9% Apache Struts 2.x before 2.3.24.1 allows remote attackers to manipulate Struts internals, alter user sessions, or affect container settings via vecto… Struts Mitigation only Fix from $1,9502017-08-29 CRITICAL 9.8 CVE-2017-9800EPSS 19% A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run … Subversion after 1.8.18 Fix from $2,3002017-08-11 HIGH 7.5 CVE-2017-9801EPSS 6% When a call-site passes a subject for an email that contains line-breaks in Apache Commons Email 1.0 through 1.4, the caller can add arbitrary SMTP h… Commons Email Mitigation only Fix from $1,9502017-08-07 HIGH 7.5 CVE-2016-2161EPSS 21% In Apache HTTP Server versions 2.4.0 to 2.4.23, malicious input to mod_auth_digest can cause the server to crash, and each instance continues to cras… HTTP Server Mitigation only Fix from $1,9502017-07-27 CRITICAL 9.1 CVE-2017-9788EPSS 57% In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or… HTTP Server after 2.4.26 Fix from $2,3002017-07-13 MEDIUM 5.9 CVE-2017-7672EPSS 9% If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used t… Struts Mitigation only Fix from $1,6002017-07-13 CRITICAL 9.8 CVE-2017-9791 KEVEPSS 99% The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the Act… Struts Patch available Fix from $2,3002017-07-10 MEDIUM 6.5 CVE-2015-3254EPSS 5% The client libraries in Apache Thrift before 0.9.3 might allow remote authenticated users to cause a denial of service (infinite recursion) via vecto… Thrift after 0.9.2 Fix from $1,6002017-06-16 CRITICAL 9.8 CVE-2017-7676 Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '*' wildcard character - like my*test, test*.txt. This can result in u… Ranger after 0.7.0 Fix from $2,3002017-06-14 HIGH 7.5 CVE-2015-5175EPSS 11% Application plugins in Apache CXF Fediz before 1.1.3 and 1.2.x before 1.2.1 allow remote attackers to cause a denial of service. Cxf Fediz after 1.1.2 Fix from $1,9502017-06-07 HIGH 7.5 CVE-2017-7669 In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. W… Hadoop Mitigation only Fix from $1,9502017-06-05 HIGH 7.3 CVE-2017-3162EPSS 6% HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace. The NameNode is provided as a query parameter that is not validate… Hadoop after 2.6.5 Fix from $1,9502017-04-26