CVE-2023-25197

Apache Fineract has a SQL injection vulnerability (CVE-2023-25197) due to improper neutralization of special elements in certain procedure calls. Affected versions are 1.4 through 1.8.2 (some sources note up to 1.8.3). Authorized users may exploit this with limited impact on components. The root ...

CVE-2023-25196 Apache Fineract: SQL injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Software Foundation Apache Fineract. Authorized users may be able to change or add data in certain components. This issue affects Apache Fineract: from 1.4 through 1.8.2...

CVE-2023-25196 Apache Fineract: SQL injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Software Foundation Apache Fineract. Authorized users may be able to change or add data in certain components. This issue affects Apache Fineract: from 1.4 through 1.8.2...

CVE-2023-25196

The CVE-2023-25196 entry concerns an SQL Injection vulnerability in Apache Fineract. Affected software is Apache Fineract versions 1.4 through 1.8.2 (as per multiple sources). The root cause is improper neutralization of special elements used in SQL commands, enabling authorized users to change o...

CVE-2023-25195 Apache Fineract: SSRF template type vulnerability in certain authenticated users

Server-Side Request Forgery SSRF vulnerability in Apache Software Foundation Apache Fineract. Authorized users with limited permissions can gain access to server and may be able to use server for any outbound traffic. This issue affects Apache Fineract: from 1.4 through 1.8.3...

CVE-2023-27296

CVE-2023-27296 affects Apache InLong versions 1.1.0–1.5.0. The root cause is unsafe deserialization of untrusted data in the JDBC flow (notably MySQLDataNode), enabling potential code execution. Impact is high (CVSS 3.1 base score 8.8; Confidentiality, Integrity, Availability all High). A fix exi...

GHSA-RWRX-X2HW-9H5W Apache Sling Resource Merger has Excessive Iteration vulnerability

Excessive Iteration vulnerability in Apache Software Foundation Apache Sling Resource Merger. This issue affects Apache Sling Resource Merger: from 1.2.0 before 1.4.2...

CVE-2023-26513

CVE-2023-26513 describes an Excessive Iteration vulnerability in the Apache Sling Resource Merger. Affected: Apache Sling Resource Merger versions 1.2.0 through 1.4.2. Root cause: not explicitly detailed beyond the excessive iteration issue in the Resource Merger. Impact: potential DoS via reques...

CVE-2023-26513 Apache Sling Resource Merger: Requests to certain paths managed by the Apache Sling Resource Merger can lead to DoS

Excessive Iteration vulnerability in Apache Software Foundation Apache Sling Resource Merger.This issue affects Apache Sling Resource Merger: from 1.2.0 before 1.4.2...

CVE-2023-26513: Excessive Iteration

Excessive Iteration vulnerability in Apache Software Foundation Apache Sling Resource Merger.This issue affects Apache Sling Resource Merger: from 1.2.0 before 1.4.2...

Sensitive Information in Error Messages in Apache Airflow

Generation of Error Message Containing Sensitive Information vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: before 2.5.2. The traceback contains information that might be useful for a potential attacker to better target their attack Python/Airflow...

Information disclosure

Generation of Error Message Containing Sensitive Information vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: before 2.5.2...

CVE-2023-25695 Information disclosure in Apache Airflow

Generation of Error Message Containing Sensitive Information vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: before 2.5.2...

GHSA-MRPV-5PMR-P92H Improper Privilege Management in Apache Sling

Privilege Escalation vulnerability in Apache Software Foundation Apache Sling. Any content author is able to create i18n dictionaries in the repository in a location the author has write access to. As these translations are used across the whole product, it allows an author to change any text or...

CVE-2023-25621

CVE-2023-25621 (Apache Sling i18n) : The i18n module is vulnerable to privilege escalation because any content author with write access can create or modify i18n dictionaries anywhere in the repository, allowing changes to any text/dialog across the product. Affected versions: Sling i18n up to 2....

Privilege escalation

Improper Privilege Management vulnerability in Apache Software Foundation Apache ShenYu. ShenYu Admin allows low-privilege low-level administrators create users with higher privileges than their own. This issue affects Apache ShenYu: 2.5.0. Upgrade to Apache ShenYu 2.5.1 or apply patch...

CVE-2022-42735

CVE-2022-42735 is an Improper Privilege Management vulnerability in Apache ShenYu where a low-privilege admin (ShenYu Admin) can create users with higher privileges than their own. The issue affects Apache ShenYu 2.5.0. The documented remediation is to upgrade to ShenYu 2.5.1 or apply the patch f...

CVE-2023-24997 Apache InLong: Jdbc Connection Security Bypass

Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.5.0. Users are advised to upgrade to Apache InLong's latest version or cherry-pick https://github.com/apache/inlong/pull/7223...

Cross site scripting

Out-of-bounds Read vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.5.0. Users are advised to upgrade to Apache InLong's latest version or cherry-pick https://github.com/apache/inlong/pull/7214...

CVE-2023-24977

CVE-2023-24977 is an Out-of-bounds Read vulnerability affecting Apache InLong versions 1.1.0 through 1.5.0. The Red Hat and CVE records describe it as an information-disclosure risk via an out-of-bounds read, with a remediation path to upgrade to the latest InLong release or to cherry-pick the pa...