Apache

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-44140 1Apache 1Jspwiki Jun 17, 2026 Nov 24, 2021 N/A· v4 9.1 CRITICAL· v3 6.4 MEDIUM· v2 Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on logout, given that those files are reachable to the user running t...Show more Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on logout, given that those files are reachable to the user running the JSPWiki instance. Apache JSPWiki users should upgrade to 2.11.0 or later.Show less
CVE-2021-40369 1Apache 1Jspwiki Jun 17, 2026 Nov 24, 2021 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Denounce plugin, which could allow the attacker to execute javascript in the victim's browser and get some s...Show more A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Denounce plugin, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.0 or later.Show less
CVE-2021-43557 1Apache 1Apisix Jun 17, 2026 Nov 22, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification. The $request_uri is the full original request URI without normalization. This makes it possible to construct a URI to bypass the...Show more The uri-block plugin in Apache APISIX before 2.10.2 uses $request_uri without verification. The $request_uri is the full original request URI without normalization. This makes it possible to construct a URI to bypass the block list on some occasions. For instance, when the block list contains "^/internal/", a URI like `//internal/` can be used to bypass it. Some other plugins also have the same issue. And it may affect the developer's custom plugin.Show less
CVE-2021-41532 1Apache 1Ozone Jun 17, 2026 Nov 19, 2021 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 In Apache Ozone before 1.2.0, Recon HTTP endpoints provide access to OM, SCM and Datanode metadata. Due to a bug, any unauthenticated user can access the data from these endpoints.
CVE-2021-39236 1Apache 1Ozone Jun 17, 2026 Nov 19, 2021 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 In Apache Ozone before 1.2.0, Authenticated users with valid Ozone S3 credentials can create specific OM requests, impersonating any other user.
CVE-2021-39235 1Apache 1Ozone Jun 17, 2026 Nov 19, 2021 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 In Apache Ozone before 1.2.0, Ozone Datanode doesn't check the access mode parameter of the block token. Authenticated users with valid READ block token can do any write operation on the same block.
CVE-2021-39234 1Apache 1Ozone Jun 17, 2026 Nov 19, 2021 N/A· v4 6.8 MEDIUM· v3 4.9 MEDIUM· v2 In Apache Ozone versions prior to 1.2.0, Authenticated users knowing the ID of an existing block can craft specific request allowing access those blocks, bypassing other security checks like ACL.
CVE-2021-39233 1Apache 1Ozone Jun 17, 2026 Nov 19, 2021 N/A· v4 9.1 CRITICAL· v3 6.4 MEDIUM· v2 In Apache Ozone versions prior to 1.2.0, Container related Datanode requests of Ozone Datanode were not properly authorized and can be called by any client.
CVE-2021-39232 1Apache 1Ozone Jun 17, 2026 Nov 19, 2021 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 In Apache Ozone versions prior to 1.2.0, certain admin related SCM commands can be executed by any authenticated users, not just by admins.
CVE-2021-39231 1Apache 1Ozone Jun 17, 2026 Nov 19, 2021 N/A· v4 9.1 CRITICAL· v3 6.4 MEDIUM· v2 In Apache Ozone versions prior to 1.2.0, Various internal server-to-server RPC endpoints are available for connections, making it possible for an attacker to download raw data from Datanode and Ozone manager and modify R...Show more In Apache Ozone versions prior to 1.2.0, Various internal server-to-server RPC endpoints are available for connections, making it possible for an attacker to download raw data from Datanode and Ozone manager and modify Ratis replication configuration.Show less
CVE-2021-36372 1Apache 1Ozone Jun 17, 2026 Nov 19, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 In Apache Ozone versions prior to 1.2.0, Initially generated block tokens are persisted to the metadata database and can be retrieved with authenticated users with permission to the key. Authenticated users may use them...Show more In Apache Ozone versions prior to 1.2.0, Initially generated block tokens are persisted to the metadata database and can be retrieved with authenticated users with permission to the key. Authenticated users may use them even after access is revoked.Show less
CVE-2021-42250 1Apache 1Superset Jun 17, 2026 Nov 17, 2021 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 Improper output neutralization for Logs. A specific Apache Superset HTTP endpoint allowed for an authenticated user to forge log entries or inject malicious content into logs.
CVE-2021-37580 1Apache 1Shenyu Jun 17, 2026 Nov 16, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected Apache ShenYu 2.3.0 and 2.4.0
CVE-2021-41972 1Apache 1Superset Jun 17, 2026 Nov 12, 2021 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 Apache Superset up to and including 1.3.1 allowed for database connections password leak for authenticated users. This information could be accessed in a non-trivial way.
CVE-2021-43350 1Apache 1Traffic Control Jun 17, 2026 Nov 11, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 An unauthenticated Apache Traffic Control Traffic Ops user can send a request with a specially-crafted username to the POST /login endpoint of any API version to inject unsanitized content into the LDAP filter.
CVE-2021-26558 1Apache 1Shardingsphere Ui Jun 17, 2026 Nov 11, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Deserialization of Untrusted Data vulnerability of Apache ShardingSphere-UI allows an attacker to inject outer link resources. This issue affects Apache ShardingSphere-UI Apache ShardingSphere-UI version 4.1.1 and later...Show more Deserialization of Untrusted Data vulnerability of Apache ShardingSphere-UI allows an attacker to inject outer link resources. This issue affects Apache ShardingSphere-UI Apache ShardingSphere-UI version 4.1.1 and later versions; Apache ShardingSphere-UI versions prior to 5.0.0.Show less
CVE-2021-43082 1Apache 1Traffic Server Jun 17, 2026 Nov 3, 2021 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the stats-over-http plugin of Apache Traffic Server allows an attacker to overwrite memory. This issue affects Apache Traffic Server...Show more Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the stats-over-http plugin of Apache Traffic Server allows an attacker to overwrite memory. This issue affects Apache Traffic Server 9.1.0.Show less
CVE-2021-41585 1Apache 1Traffic Server Jun 17, 2026 Nov 3, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Improper Input Validation vulnerability in accepting socket connections in Apache Traffic Server allows an attacker to make the server stop accepting new connections. This issue affects Apache Traffic Server 5.0.0 to 9.1...Show more Improper Input Validation vulnerability in accepting socket connections in Apache Traffic Server allows an attacker to make the server stop accepting new connections. This issue affects Apache Traffic Server 5.0.0 to 9.1.0.Show less
CVE-2021-38161 2Apache Debian 2Debian Linux Traffic Server Jun 17, 2026 Nov 3, 2021 N/A· v4 8.1 HIGH· v3 6.8 MEDIUM· v2 Improper Authentication vulnerability in TLS origin verification of Apache Traffic Server allows for man in the middle attacks. This issue affects Apache Traffic Server 8.0.0 to 8.0.8.
CVE-2021-37149 2Apache Debian 2Debian Linux Traffic Server Jun 17, 2026 Nov 3, 2021 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Improper Input Validation vulnerability in header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 8.1.2 and 9.0.0 to 9.1.0.

Previous 1...727374...157 Next