58.507 CVE tracked
796 Exploited now
188 Used by ransomware
Last sync
Apache vulnerabilities
3430 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2002-2012 | MED 5.0 | apache http_server Unknown vulnerability in Apache 1.3.19 running on HP Secure OS for Linux 1.0 allows remote attackers to cause "unexpected results" via an HTTP request. | 6.0% | — |
| CVE-2024-29868 | CRIT 9.1 | apache streampipes Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) vulnerability in Apache StreamPipes user self-registration and password recovery mechanism. This allows an attacker to guess the recovery token in a reasonable time and thereby to take over th | 6.0% | — |
| CVE-2011-1921 | MED 4.3 | apache subversion The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x and 1.6.x before 1.6.17, when the SVNPathAuthz short_circuit option is disabled, does not properly enforce permissions for files that had been publicly readable in the | 6.0% | — |
| CVE-2003-0192 | MED 6.4 | apache http_server Apache 2 before 2.0.47, and certain versions of mod_ssl for Apache 1.3, do not properly handle "certain sequences of per-directory renegotiations and the SSLCipherSuite directive being used to upgrade from a weak ciphersuite to a strong one," which could cause | 6.0% | — |
| CVE-2024-30188 | HIGH 8.1 | apache dolphinscheduler File read and write vulnerability in Apache DolphinScheduler , authenticated users can illegally access additional resource files. This issue affects Apache DolphinScheduler: from 3.1.0 before 3.2.2. Users are recommended to upgrade to version 3.2.2, which f | 6.0% | — |
| CVE-2024-27135 | HIGH 8.5 | apache pulsar Improper input validation in the Pulsar Function Worker allows a malicious authenticated user to execute arbitrary Java code on the Pulsar Function worker, outside of the sandboxes designated for running user-provided functions. This vulnerability also applies | 6.0% | — |
| CVE-2017-12174 | HIGH 7.5 | apache artemis It was found that when Artemis and HornetQ before 2.4.0 are configured with UDP discovery and JGroups discovery a huge byte array is created when receiving an unexpected multicast message. This may result in a heap memory exhaustion, full GC, or OutOfMemoryErr | 6.0% | — |
| CVE-2005-3510 | MED 5.0 | apache tomcat Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous requests to list a web directory that has a large number of files. | 6.0% | — |
| CVE-2010-4494 | HIGH 7.5 | apache openoffice Double free vulnerability in libxml2 2.7.8 and other versions, as used in Google Chrome before 8.0.552.215 and other products, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to XPath handling. | 5.9% | — |
| CVE-2013-2172 | MED 4.3 | apache santuario_xml_security_for_java jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify a | 5.9% | — |
| CVE-2009-5005 | MED 5.0 | apache qpid The Cluster::deliveredEvent function in cluster/Cluster.cpp in Apache Qpid, as used in Red Hat Enterprise MRG before 1.3 and other products, allows remote attackers to cause a denial of service (daemon crash and cluster outage) via invalid AMQP data. | 5.9% | — |
| CVE-2010-3854 | MED 4.3 | apache couchdb Multiple cross-site scripting (XSS) vulnerabilities in the web administration interface (aka Futon) in Apache CouchDB 0.8.0 through 1.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. | 5.9% | — |
| CVE-2015-1835 | MED 5.3 | apache cordova Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in config.xml, allows remote attackers to modify undefined secondary configuration variables (preferences) via a crafted intent: URL. | 5.9% | — |
| CVE-2013-4558 | LOW 3.5 | apache mod_dav_svn The get_parent_resource function in repos.c in mod_dav_svn Apache HTTPD server module in Subversion 1.7.11 through 1.7.13 and 1.8.1 through 1.8.4, when built with assertions enabled and SVNAutoversioning is enabled, allows remote attackers to cause a denial of | 5.9% | — |
| CVE-2013-1845 | LOW 2.1 | apache subversion The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (memory consumption) by (1) setting or (2) deleting a large number of properties for a file or d | 5.9% | — |
| CVE-2017-5643 | HIGH 7.4 | apache camel Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE. | 5.9% | — |
| CVE-2002-1394 | HIGH 7.5 | apache tomcat Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148. | 5.9% | — |
| CVE-2023-45648 | MED 5.3 | apache tomcat Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially crafted, in | 5.8% | — |
| CVE-2012-5639 | MED 6.5 | apache openoffice LibreOffice and OpenOffice automatically open embedded content | 5.8% | — |
| CVE-2013-2756 | MED 5.0 | apache cloudstack Apache CloudStack 4.0.0 before 4.0.2 and Citrix CloudPlatform (formerly Citrix CloudStack) 3.0.x before 3.0.6 Patch C allows remote attackers to bypass the console proxy authentication by leveraging knowledge of the source code. | 5.8% | — |
| CVE-2012-6153 | MED 4.3 | apache commons-httpclient http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-mi | 5.8% | — |
| CVE-2013-2155 | MED 5.8 | apache xml_security_for_c\+\+ Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 does not properly validate length values, which allows remote attackers to cause a denial of service or bypass the CVE-2009-0217 protection mechanism and spoof a signature via crafted leng | 5.8% | — |
| CVE-2022-22728 | HIGH 7.5 | apache libapreq2 A flaw in Apache libapreq2 versions 2.16 and earlier could cause a buffer overflow while processing multipart form uploads. A remote attacker could send a request causing a process crash which could lead to a denial of service attack. | 5.8% | — |
| CVE-2015-2992 | MED 6.1 | apache struts Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability. | 5.8% | — |
| CVE-2019-10095 | CRIT 9.8 | apache zeppelin bash command injection vulnerability in Apache Zeppelin allows an attacker to inject system commands into Spark interpreter settings. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions. | 5.7% | — |