Apache CVEs — known vulnerabilities

Openmeetings MEDIUM 6.1

CVE-2016-3089

Cross-site scripting (XSS) vulnerability in the SWF panel in Apache OpenMeetings before 3.1.2 allows remote attackers to inject arbitrary web script …

Fix: after 3.1.1

Fix from $1,600 2016-08-19

Sentry HIGH 8.8

CVE-2016-0760

Multiple incomplete blacklist vulnerabilities in Apache Sentry before 1.7.0 allow remote authenticated users to execute arbitrary code via the (1) re…

Mitigation only

Fix from $1,950 2016-08-19

Activemq MEDIUM 5.4

CVE-2016-0782EPSS 6%

The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users…

No fix yet

Fix from $1,600 2016-08-05

Poi MEDIUM 5.5

CVE-2016-5000

The XLSX2CSV example in Apache POI before 3.14 allows remote attackers to read arbitrary files via a crafted OpenXML document containing an external …

Fix: after 3.13

Fix from $1,600 2016-08-05

Openoffice HIGH 7.8

CVE-2016-1513

The Impress tool in Apache OpenOffice 4.1.2 and earlier allows remote attackers to cause a denial of service (out-of-bounds read or write) or execute…

Fix: after 4.1.2

Fix from $1,950 2016-08-05

Archiva HIGH 8.8

CVE-2016-4469EPSS 8%

Multiple cross-site request forgery (CSRF) vulnerabilities in Apache Archiva 1.3.9 and earlier allow remote attackers to hijack the authentication of…

Fix: after 1.3.9

Fix from $1,950 2016-07-28

HTTP Server HIGH 8.1

CVE-2016-5387EPSS 56%

The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted clie…

Fix: after 2.4.23

Fix from $1,950 2016-07-19

Amqp 0 X Jms Client HIGH 7.5

CVE-2016-4974EPSS 6%

Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS (AMQP 1.0) before 0.10.0 does not restrict the use of classes available on the classpath, which …

Fix: after 6.0.3

Fix from $1,950 2016-07-13

Xerces C\+\+ HIGH 7.5

CVE-2016-4463EPSS 14%

Stack-based buffer overflow in Apache Xerces-C++ before 3.1.4 allows context-dependent attackers to cause a denial of service via a deeply nested DTD.

Fix: after 3.1.3

Fix from $1,950 2016-07-08

HTTP Server HIGH 7.5

CVE-2016-4979EPSS 19%

The Apache HTTP Server 2.4.18 through 2.4.20, when mod_http2 and mod_ssl are enabled, does not properly recognize the "SSLVerifyClient require" direc…

Patch available

Fix from $1,950 2016-07-06

HTTP Server MEDIUM 5.9

CVE-2016-1546EPSS 15%

The Apache HTTP Server 2.4.17 and 2.4.18, when mod_http2 is enabled, does not limit the number of simultaneous stream workers for a single HTTP/2 con…

Patch available

Fix from $1,600 2016-07-06

Struts MEDIUM 5.3

CVE-2016-4465EPSS 10%

The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of service via a n…

Mitigation only

Fix from $1,600 2016-07-04

Struts CRITICAL 9.8

CVE-2016-4438EPSS 17%

The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression.

Mitigation only

Fix from $2,300 2016-07-04

Struts HIGH 7.5

CVE-2016-4433EPSS 10%

Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted …

Mitigation only