Browse CVEs

MEDIUM 5.3 CVE-2022-45438 When explicitly enabling the feature flag DASHBOARD_CACHE (disabled by default), the system allowed for an unauthenticated user to access dashboard c… Superset after 1.5.2 Fix from $1,6002023-01-16 HIGH 7.5 CVE-2023-22602 When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authe… Shiro 1.11.0+ Fix from $1,9502023-01-14 MEDIUM 5.4 CVE-2022-46769 An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.2 and pri… Sling Cms 1.1.4+ Fix from $1,6002023-01-09 MEDIUM 5.5 CVE-2022-45787 Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvider may lead to information disclosure to other local users. Th… James 0.8.9+ Fix from $1,6002023-01-06 MEDIUM 5.5 CVE-2022-45935 Usage of temporary files with insecure permissions by the Apache James server allows an attacker with local access to access private user data in tra… James after 3.7.2 Fix from $1,6002023-01-06 CRITICAL 9.8 CVE-2022-45875 Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability. This issue affects… Dolphinscheduler 3.0.2+ Fix from $2,3002023-01-04 HIGH 7.5 CVE-2022-45143 The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In… Tomcat 9.0.69+ Fix from $1,9502023-01-03 CRITICAL 9.8 CVE-2021-32824 Apache Dubbo is a java based, open source RPC framework. Versions prior to 2.6.10 and 2.7.10 are vulnerable to pre-auth remote code execution via arb… Dubbo 2.6.10 / 2.7.10+ Fix from $2,3002023-01-03 CRITICAL 9.8 CVE-2022-44621 Diagnosis Controller miss parameter validation, so user may attacked by command injection via HTTP Request. Kylin 4.0.3+ Fix from $2,3002022-12-30 HIGH 8.8 CVE-2022-43396EPSS 55% In the fix for CVE-2022-24697, a blacklist is used to filter user input commands. But there is a risk of being bypassed. The user can control the com… Kylin 4.0.3+ Fix from $1,9502022-12-30 CRITICAL 9.8 CVE-2022-45347 Apache ShardingSphere-Proxy prior to 5.3.0 when using MySQL as database backend didn't cleanup the database session completely after client authentic… Shardingsphere 5.3.0+ Fix from $2,3002022-12-22 CRITICAL 9.8 CVE-2022-40145 This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL. The function … Karaf 4.3.8 / 4.4.2+ Fix from $2,3002022-12-21 CRITICAL 9.8 CVE-2022-46421 Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow Hive P… Apache Airflow Providers Apache Hive 5.0.0+ Fix from $2,3002022-12-20 MEDIUM 6.1 CVE-2022-40743 Improper Input Validation vulnerability for the xdebug plugin in Apache Software Foundation Apache Traffic Server can lead to cross site scripting an… Traffic Server after 9.1.3 Fix from $1,6002022-12-19 MEDIUM 6.1 CVE-2022-47500 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Software Foundation Apache Helix UI component.This issue affects Apache H… Helix after 1.0.4 Fix from $1,6002022-12-19 HIGH 7.5 CVE-2022-32749 Improper Check for Unusual or Exceptional Conditions vulnerability handling requests in Apache Traffic Server allows an attacker to crash the server … Traffic Server 8.1.6 / 9.1.4+ Fix from $1,9502022-12-19 MEDIUM 5.3 CVE-2022-37392 Improper Check for Unusual or Exceptional Conditions vulnerability in handling the requests to Apache Traffic Server. This issue affects Apache Traf… Traffic Server 8.1.6 / 9.1.4+ Fix from $1,6002022-12-19 MEDIUM 5.4 CVE-2022-46870 An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Zeppelin allows logged-in users to ex… Zeppelin 0.8.2+ Fix from $1,6002022-12-16 MEDIUM 6.5 CVE-2021-28655 The improper Input Validation vulnerability in "”Move folder to Trash” feature of Apache Zeppelin allows an attacker to delete the arbitrary files. … Zeppelin after 0.9.0 Fix from $1,6002022-12-16 MEDIUM 5.9 CVE-2022-32531 The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname verificati… Bookkeeper 4.14.6+ Fix from $1,6002022-12-15 HIGH 8.8 CVE-2022-34271 A vulnerability in import module of Apache Atlas allows an authenticated user to write to web server filesystem. This issue affects Apache Atlas ver… Atlas after 2.2.0 Fix from $1,9502022-12-14 CRITICAL 9.8 CVE-2022-46364 A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attack… Cxf 3.4.10 / 3.5.5+ Fix from $2,3002022-12-13 HIGH 7.5 CVE-2022-46363 A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration. The vul… Cxf 3.4.10 / 3.5.5+ Fix from $1,9502022-12-13 MEDIUM 5.3 CVE-2022-45910 Improper neutralization of special elements used in an LDAP query ('LDAP Injection') vulnerability in ActiveDirectory and Sharepoint ActiveDirectory … Manifoldcf after 2.23 Fix from $1,6002022-12-07 MEDIUM 6.5 CVE-2021-37533 Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net co… Commons Net 3.9.0+ Fix from $1,6002022-12-03 CRITICAL 9.8 CVE-2022-46366 Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. This issue is similar to but distinct from CVE-2020-1… Tapestry 4.0.0+ Fix from $2,3002022-12-02 HIGH 8.8 CVE-2022-44635EPSS 69% Apache Fineract allowed an authenticated user to perform remote code execution due to a path traversal vulnerability in a file upload component of Ap… Fineract 1.8.1+ Fix from $1,9502022-11-29 HIGH 7.5 CVE-2022-26885 When using tasks to read config files, there is a risk of database password disclosure. We recommend you upgrade to version 2.0.6 or higher. Dolphinscheduler 2.0.6+ Fix from $1,9502022-11-24 CRITICAL 9.8 CVE-2022-45462 Alarm instance management has command injection when there is a specific command configured. It is only for logged-in users. We recommend you upgrade… Dolphinscheduler 2.0.6+ Fix from $2,3002022-11-23 CRITICAL 9.8 CVE-2022-40189 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pig Provider, Apache Airfl… Airflow 2.3.0 / 4.0.0+ Fix from $2,3002022-11-22