Apache

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2016-3092 4Apache CanonicalDebian+1 more 6Commons Fileupload Debian LinuxIcewall Identity Manager+3 more May 6, 2026 Jul 4, 2016 N/A· v4 7.5 HIGH· v3 7.8 HIGH· v2 The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers...Show more The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.Show less
CVE-2016-1182 1Apache 1Struts May 6, 2026 Jul 4, 2016 N/A· v4 8.2 HIGH· v3 6.4 MEDIUM· v2 ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service vi...Show more ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.Show less
CVE-2016-1181 2Apache Oracle 3Banking Platform PortalStruts May 6, 2026 Jul 4, 2016 N/A· v4 8.1 HIGH· v3 6.8 MEDIUM· v2 ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory...Show more ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899.Show less
CVE-2015-0899 1Apache 1Struts May 6, 2026 Jul 4, 2016 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.
CVE-2016-2174 1Apache 1Ranger May 6, 2026 Jun 13, 2016 N/A· v4 7.2 HIGH· v3 6.5 MEDIUM· v2 SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows remote authenticated administrators to execute arbitrary SQL commands via the eventTime parameter to service/plugins/policies/even...Show more SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows remote authenticated administrators to execute arbitrary SQL commands via the eventTime parameter to service/plugins/policies/eventTime.Show less
CVE-2016-3085 1Apache 1Cloudstack May 6, 2026 Jun 10, 2016 N/A· v4 6.5 MEDIUM· v3 5.8 MEDIUM· v2 Apache CloudStack 4.5.x before 4.5.2.1, 4.6.x before 4.6.2.1, 4.7.x before 4.7.1.1, and 4.8.x before 4.8.0.1, when SAML-based authentication is enabled and used, allow remote attackers to bypass authentication and access...Show more Apache CloudStack 4.5.x before 4.5.2.1, 4.6.x before 4.6.2.1, 4.7.x before 4.7.1.1, and 4.8.x before 4.8.0.1, when SAML-based authentication is enabled and used, allow remote attackers to bypass authentication and access the user interface via vectors related to the SAML plugin.Show less
CVE-2016-3093 2Apache Ognl Project 2Ognl Struts May 6, 2026 Jun 7, 2016 N/A· v4 5.3 MEDIUM· v3 5.0 MEDIUM· v2 Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified ve...Show more Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.Show less
CVE-2016-3087 1Apache 1Struts May 6, 2026 Jun 7, 2016 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) opera...Show more Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.Show less
CVE-2016-4437 2Apache Redhat 4Aurora FuseJboss Middleware Text Only Advisories+1 more Apr 22, 2026 Jun 7, 2016 N/A· v4 9.8 CRITICAL· v3 6.8 MEDIUM· v2 Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request para...Show more Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.Show less
CVE-2015-7611 1Apache 1James Server May 6, 2026 Jun 7, 2016 N/A· v4 8.1 HIGH· v3 9.3 HIGH· v2 Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspecified vectors.
CVE-2016-4432 1Apache 1Qpid Broker J May 6, 2026 Jun 1, 2016 N/A· v4 9.1 CRITICAL· v3 5.0 MEDIUM· v2 The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication and consequently perform actions via vectors related to connection state loggin...Show more The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication and consequently perform actions via vectors related to connection state logging.Show less
CVE-2016-3094 1Apache 1Qpid Broker J May 6, 2026 Jun 1, 2016 N/A· v4 5.9 MEDIUM· v3 4.3 MEDIUM· v2 PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allows remote attackers to cause a denial of service (broker termination) via a crafted authentication at...Show more PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allows remote attackers to cause a denial of service (broker termination) via a crafted authentication attempt, which triggers an uncaught exception.Show less
CVE-2016-3088 1Apache 1Activemq Apr 21, 2026 Jun 1, 2016 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.
CVE-2016-2175 2Apache Debian 2Debian Linux Pdfbox May 6, 2026 Jun 1, 2016 N/A· v4 7.8 HIGH· v3 7.5 HIGH· v2 Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.
CVE-2016-0731 1Apache 1Ambari May 6, 2026 May 18, 2016 N/A· v4 4.9 MEDIUM· v3 4.0 MEDIUM· v2 The File Browser View in Apache Ambari before 2.2.1 allows remote authenticated administrators to read arbitrary files via a file: URL in the WebHDFS URL configuration.
CVE-2016-0707 1Apache 1Ambari May 6, 2026 May 18, 2016 N/A· v4 3.3 LOW· v3 2.1 LOW· v2 The agent in Apache Ambari before 2.1.2 uses weak permissions for the (1) /var/lib/ambari-agent/data and (2) /var/lib/ambari-agent/keys directories, which allows local users to obtain sensitive information by reading fil...Show more The agent in Apache Ambari before 2.1.2 uses weak permissions for the (1) /var/lib/ambari-agent/data and (2) /var/lib/ambari-agent/keys directories, which allows local users to obtain sensitive information by reading files in the directories.Show less
CVE-2016-2099 2Apache Opensuse 2Opensuse Xerces C++ May 6, 2026 May 13, 2016 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Use-after-free vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 3.1.3 and earlier allows context-dependent attackers to have unspecified impact via an invalid character in an XML document.
CVE-2015-5208 1Apache 1Cordova May 6, 2026 May 9, 2016 N/A· v4 4.4 MEDIUM· v3 4.3 MEDIUM· v2 Apache Cordova iOS before 4.0.0 allows remote attackers to execute arbitrary plugins via a link.
CVE-2015-5207 1Apache 1Cordova May 6, 2026 May 9, 2016 N/A· v4 5.3 MEDIUM· v3 7.5 HIGH· v2 Apache Cordova iOS before 4.0.0 might allow attackers to bypass a URL whitelist protection mechanism in an app and load arbitrary resources by leveraging unspecified methods.
CVE-2016-2168 1Apache 1Subversion May 6, 2026 May 5, 2016 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 The req_check_access function in the mod_authz_svn module in the httpd server in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4 allows remote authenticated users to cause a denial of service (NULL pointer derefer...Show more The req_check_access function in the mod_authz_svn module in the httpd server in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4 allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via a crafted header in a (1) MOVE or (2) COPY request, involving an authorization check.Show less

Previous 1...132133134...169 Next