Apache

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2012-5636 1Apache 1Wicket May 13, 2026 Oct 30, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.22, 1.5.x before 1.5.10, and 6.x before 6.4.0 might allow remote attackers to inject arbitrary web script or HTML via vectors related to <script>...Show more Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.22, 1.5.x before 1.5.10, and 6.x before 6.4.0 might allow remote attackers to inject arbitrary web script or HTML via vectors related to <script> tags in a rendered response.Show less
CVE-2012-4449 1Apache 1Hadoop May 13, 2026 Oct 30, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Apache Hadoop before 0.23.4, 1.x before 1.0.4, and 2.x before 2.0.2 generate token passwords using a 20-bit secret when Kerberos security features are enabled, which makes it easier for context-dependent attackers to cra...Show more Apache Hadoop before 0.23.4, 1.x before 1.0.4, and 2.x before 2.0.2 generate token passwords using a 20-bit secret when Kerberos security features are enabled, which makes it easier for context-dependent attackers to crack secret keys via a brute-force attack.Show less
CVE-2014-0115 1Apache 1Storm May 13, 2026 Oct 30, 2017 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 Directory traversal vulnerability in the log viewer in Apache Storm 0.9.0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter to log.
CVE-2012-0881 1Apache 1Xerces2 Java May 13, 2026 Oct 30, 2017 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an XML service, which triggers hash table collisions.
CVE-2009-1198 1Apache 1Juddi May 13, 2026 Oct 30, 2017 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in Apache jUDDI before 2.0 allows remote attackers to inject arbitrary web script or HTML via the dsname parameter to happyjuddi.jsp.
CVE-2009-1197 1Apache 1Juddi May 13, 2026 Oct 30, 2017 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 Apache jUDDI before 2.0 allows attackers to spoof entries in log files via vectors related to error logging of keys from uddiget.jsp.
CVE-2016-3090 1Apache 1Struts May 13, 2026 Oct 30, 2017 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 The TextParseUtil.translateVariables method in Apache Struts 2.x before 2.3.20 allows remote attackers to execute arbitrary code via a crafted OGNL expression with ANTLR tooling.
CVE-2015-3249 1Apache 1Traffic Server May 13, 2026 Oct 30, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.1 allows remote attackers to cause a denial of service (out-of-bounds access and daemon crash) or possibly execute arbitrary code via vectors rela...Show more The HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.1 allows remote attackers to cause a denial of service (out-of-bounds access and daemon crash) or possibly execute arbitrary code via vectors related to the (1) frame_handlers array or (2) set_dynamic_table_size function.Show less
CVE-2015-0226 1Apache 1Wss4j May 13, 2026 Oct 30, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers to recover the plainte...Show more Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers to recover the plaintext form of a symmetric key via a series of crafted messages. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-2487.Show less
CVE-2015-0224 1Apache 1Qpid May 13, 2026 Oct 30, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 qpidd in Apache Qpid 0.30 and earlier allows remote attackers to cause a denial of service (daemon crash) via a crafted protocol sequence set. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-02...Show more qpidd in Apache Qpid 0.30 and earlier allows remote attackers to cause a denial of service (daemon crash) via a crafted protocol sequence set. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0203.Show less
CVE-2014-3624 1Apache 1Traffic Server May 13, 2026 Oct 30, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Apache Traffic Server 5.1.x before 5.1.1 allows remote attackers to bypass access restrictions by leveraging failure to properly tunnel remap requests using CONNECT.
CVE-2014-3526 1Apache 1Wicket May 13, 2026 Oct 30, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive information via vectors involving identifiers for storing page markup for temporary user sessions.
CVE-2013-4246 1Apache 1Subversion May 13, 2026 Oct 30, 2017 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 libsvn_fs_fs/fs_fs.c in Apache Subversion 1.8.x before 1.8.2 might allow remote authenticated users with commit access to corrupt FSFS repositories and cause a denial of service or obtain sensitive information by editing...Show more libsvn_fs_fs/fs_fs.c in Apache Subversion 1.8.x before 1.8.2 might allow remote authenticated users with commit access to corrupt FSFS repositories and cause a denial of service or obtain sensitive information by editing packed revision properties.Show less
CVE-2015-1835 1Apache 1Cordova May 13, 2026 Oct 27, 2017 N/A· v4 5.3 MEDIUM· v3 2.6 LOW· v2 Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in config.xml, allows remote attackers to modify undefined secondary configuration variables (preferences) via a...Show more Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when an application does not set explicit values in config.xml, allows remote attackers to modify undefined secondary configuration variables (preferences) via a crafted intent: URL.Show less
CVE-2014-3600 1Apache 1Activemq May 13, 2026 Oct 27, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.
CVE-2014-3579 1Apache 1Activemq Apollo May 13, 2026 Oct 27, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 XML external entity (XXE) vulnerability in Apache ActiveMQ Apollo 1.x before 1.7.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.
CVE-2016-5003 1Apache 1Ws Xmlrpc May 13, 2026 Oct 27, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an <ex:serializable> element.
CVE-2016-5002 1Apache 1Xml Rpc May 13, 2026 Oct 27, 2017 N/A· v4 7.8 HIGH· v3 9.3 HIGH· v2 XML external entity (XXE) vulnerability in the Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted DTD.
CVE-2012-1622 1Apache 1Ofbiz May 13, 2026 Oct 26, 2017 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Apache OFBiz 10.04.x before 10.04.02 allows remote attackers to execute arbitrary code via unspecified vectors.
CVE-2017-12618 1Apache 1Portable Runtime Utility May 13, 2026 Oct 24, 2017 N/A· v4 4.7 MEDIUM· v3 1.9 LOW· v2 Apache Portable Runtime Utility (APR-util) 1.6.0 and prior fail to validate the integrity of SDBM database files used by apr_sdbm() functions, resulting in a possible out of bound read access. A local user with write ac...Show more Apache Portable Runtime Utility (APR-util) 1.6.0 and prior fail to validate the integrity of SDBM database files used by apr_sdbm() functions, resulting in a possible out of bound read access. A local user with write access to the database can make a program or process using these functions crash, and cause a denial of service.Show less

Previous 1...108109110...156 Next