CVE-2024-47552

Deserialization of Untrusted Data vulnerability in Apache Seata incubating. This issue affects Apache Seata incubating: from 2.0.0 before 2.2.0. Severity Justification: The Apache Seata security team assesses the severity of this vulnerability as "Low" due to stringent real-world mitigating...

CVE-2024-47552: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in Apache Seata incubating. This issue affects Apache Seata incubating: from 2.0.0 before 2.2.0. Severity Justification: The Apache Seata security team assesses the severity of this vulnerability as "Low" due to stringent real-world mitigating...

CVE-2024-54016: Improper Handling of Highly Compressed Data (Data Amplification)

Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Seata incubating. This issue affects Apache Seata incubating: through =2.2.0. Users are recommended to upgrade to version 2.3.0, which fixes the issue...

PT-2025-12017

Name of the Vulnerable Software and Affected Versions Apache Seata incubating versions through 2.2.0 Description The issue is related to improper handling of highly compressed data, also known as data amplification. This problem affects Apache Seata incubating. Recommendations For versions throug...

CVE-2024-45505 Apache HertzBeat: Exists Native Deser RCE and file writing vulnerabilities

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in Apache HertzBeat incubating. This vulnerability can only be exploited by authorized attackers. This issue affects Apache HertzBeat incubating: before 1.6.1. Users are recommended to upgrade to versi...

CVE-2024-45505

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in Apache HertzBeat incubating. This vulnerability can only be exploited by authorized attackers. This issue affects Apache HertzBeat incubating: before 1.6.1. Users are recommended to upgrade to versi...

SUSE CVE-2019-0202

The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm. In Apache Storm versions 0.9.1-incubating to 1.2.2, it is possible to read files off the host's file system that were not intended to be accessible via these endpoints...

K000130278: Apache Heron vulnerability CVE-2021-42010

Security Advisory Description Heron versions = 0.20.4-incubating allows CRLF log injection because of the lack of escaping in the log statements. Please update to version 0.20.5-incubating which addresses this issue. CVE-2021-42010 Impact There is no impact; F5 products are not affected by this...

CVE-2021-42010 CRLF log injection

Heron versions = 0.20.4-incubating allows CRLF log injection because of the lack of escaping in the log statements. Please update to version 0.20.5-incubating which addresses this issue...

CVE-2022-24294

CVE-2022-24294 affects Apache MXNet (incubating) prior to 1.9.1. The vulnerability is a regular-expression Denial of Service (ReDoS) in the MXNet RTC module (get_kernel path cited in sources) when loading a model with a specially crafted operator name, causing excessive resource consumption durin...

GHSA-R9PV-HG64-JQRP Exposure of Sensitive Information in Apache Storm Logviewer

The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm. In Apache Storm versions 0.9.1-incubating to 1.2.2, it is possible to read files off the host's file system that were not intended to be accessible via these endpoints...

CVE-2021-26544

Livy server version 0.7.0-incubating only is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users' sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating...

Cross site scripting

Livy server version 0.7.0-incubating only is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users' sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating...

CVE-2021-26544 Apache Livy (Incubating) is vulnerable to cross site scripting

Livy server version 0.7.0-incubating only is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users' sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating...

CVE-2021-26544

Affected software: Apache Livy server 0.7.0-incubating. Issue: cross-site scripting (XSS) in the session name. Impact: a malicious user could access logs and results of other users’ sessions and run jobs with those users’ privileges. Root cause: XSS in session-name handling. Remediation: the fixe...

CVE-2020-1939

The CVE-2020-1939 issue affects the optional ftpd component within the Apache NuttX Apps repository, not the NuttX RTOS core. A NULL pointer dereference in ftpd is the named problem. Impact is limited to users who have enabled ftpd in versions 6.15 through 8.2. The NuttX RTOS itself is not affect...

CVE-2020-1939

The Apache NuttX Incubating project provides an optional separate "apps" repository which contains various optional components and example programs. One of these, ftpd, had a NULL pointer dereference bug. The NuttX RTOS itself is not affected. Users of the optional apps repository are affected on...

Apache Storm Information Disclosure Vulnerability

Apache Storm is the United States Apache Apache Software Foundation, a set of open source distributed real-time computing system using Clojure concurrent programming language development. An information disclosure vulnerability exists in Apache Storm versions 0.9.1-incubating through 1.2.2. The...

CVE-2018-17191: Undefined Security Weakness

Apache NetBeans incubating 9.0 NetBeans Proxy Auto-Configuration PAC interpretation is vulnerable for remote command execution RCE. Using the nashorn script engine the environment of the javascript execution for the Proxy Auto-Configuration leaks privileged objects, that can be used to circumvent...

Apache Oozie User Emulation Vulnerability

Apache Oozie is a workflow scheduling system for managing Apache Hadoop jobs from the U.S. Apache Apache Software Foundation. The system supports Java map-reduce, Pig, Hive and many other types of Hadoop jobs. A security vulnerability exists in Apache Oozie versions 3.1.3-incubating through 5.0.0...