Apache OFBiz Path Traversal Vulnerability

Apache OFBiz is the United States Apache Apache Foundation of a set of enterprise resource planning ERP system. The system provides a set of Java-based Web application components and tools. Apache OFBiz suffers from a path traversal vulnerability that stems from the application failing to properl...

Apache Airflow Hive Provider Code Injection Vulnerability

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. A code injection vulnerability exists in Apache Airflow Hive Provider, which can be exploited by an attacker to execute arbitrary commands on the system...

Apache James Elevation of Privilege Vulnerability

Apache James is the United States Apache Apache Foundation of a completely written in Java open source Smtp and Pop3 mail transfer agent and Nntp news server . An elevation of privilege vulnerability exists in Apache James 3.7.3 and earlier versions, which stems from the default provisioning of J...

Apache UIMA DUCC Command Injection Vulnerability

Apache UIMA DUCC is a cluster management system from the Apache Apache Foundation in the United States. The system provides tools, management and scheduling tools. Apache UIMA DUCC suffers from a command injection vulnerability that arises from improper neutralization of specific elements used wh...

Apache Fineract SQL Injection Vulnerability (CNVD-2023-23557)

Apache Fineract is an open source digital financial services platform from the Apache Foundation. The platform can provide users with data management, loan and savings portfolio management and real-time financial data and other features. Apache Fineract versions 1.4 to 1.8.3 have a SQL injection...

Apache InLong Deserialization Vulnerability (CNVD-2023-25936)

Apache InLong is the U.S. Apache Apache Foundation's one-stop massive data integration framework. Provides automated, secure and reliable data transfer capabilities. A deserialization vulnerability exists in Apache InLong versions 1.1.0 to 1.5.0. The vulnerability stems from unsafe deserializatio...

Apache OpenOffice Code Issue Vulnerability

Apache OpenOffice is an open source office software suite from the U.S. Apache Apache Foundation. The suite contains text documents , spreadsheets , presentations , drawings , databases and so on. A code issue vulnerability exists in Apache OpenOffice versions prior to 4.1.14, which stems from th...

Apache Airflow Information Disclosure Vulnerability (CNVD-2023-23550)

Apache Airflow is an open source platform for creating, managing, and monitoring workflows from the Apache Foundation. The platform is scalable and dynamically monitored, etc. An information disclosure vulnerability exists in versions prior to Apache Airflow 2.5.2, which stems from the fact that...

Apache Dubbo code issue vulnerability (CNVD-2023-23551)

Apache Dubbo is a lightweight Java-based RPC remote procedure call framework from the Apache Foundation in the United States. The product provides interface-based remote calling, fault tolerance and load balancing, and automatic service registration and discovery.A security vulnerability exists i...

Apache Airflow Sqoop Provider Input Validation Error Vulnerability

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. An input validation error vulnerability exists in Apache Airflow Sqoop Provider...

Apache Kerby LDAP Injection Vulnerability

Apache Kerby is a Java Kerberos binding from the Apache Foundation, USA. Provides rich, intuitive, and interoperable implementations, libraries, KDCs, and facilities to integrate PKI, OTP, and tokens OAuth2 as needed for modern environments such as cloud, Hadoop, and mobile. An LDAP injection...

Apache Kafka Code Issue Vulnerability (CNVD-2023-23554)

Apache Kafka is an open source distributed streaming platform from the Apache Foundation in the United States. The platform is capable of acquiring real-time data for building applications that react in real time to changes in the data stream. A code issue vulnerability exists in Apache Kafka...

Apache ShenYu Authorization Problem Vulnerability (CNVD-2023-23553)

Apache ShenYu is an asynchronous , high-performance , cross-language , responsive API gateway of the United States Apache Apache Foundation . An authorization issue vulnerability exists in Apache ShenYu versions prior to 2.5.1, which stems from improper privilege management and can be exploited b...

Apache Sling JNDI Injection Vulnerability

Apache Sling is the United States Apache Apache Foundation of a Java platform for open source Web framework. Designed to meet the JSR-170 content repository such as Apache Jackrabbit to create content-centric applications. Apache Sling JCR Base versions prior to 3.1.12 JNDI injection vulnerabilit...

Apache NiFi XML External Entity Injection Vulnerability (CNVD-2023-23555)

Apache NiFi is a data processing and distribution system from the Apache USA Foundation. The system is primarily used for data routing, transformation and system intermediary logic. An XML external entity injection vulnerability exists in Apache NiFi versions 1.2.0 through 1.19.1, which stems fro...

Apache Superset Access Control Error Vulnerability (CNVD-2023-05217)

An access control error vulnerability exists in Apache Superset, a data visualization and data exploration platform from the Apache Foundation, which stems from improper access controls and could be exploited by an unauthenticated attacker to access dashboard configuration metadata using the REST...

Apache James licensing issue vulnerability

Apache James is an open source Smtp and Pop3 mail transfer agent and Nntp news server written entirely in Java from the Apache Foundation in the U.S. An authorization issue vulnerability exists in Apache James, which stems from a vulnerability in the MIME4J TempFileStorageProvider using improperl...

Apache Traffic Server Exception Handling Error Vulnerability

Apache Traffic Server ATS is a set of scalable HTTP proxy and caching servers from the Apache Foundation, U.S. An exception handling error vulnerability exists in Apache Traffic Server. An attacker could exploit this vulnerability to crash the server under certain conditions...

Apache Traffic Server Cross-Site Scripting Vulnerability (CNVD-2023-03922)

Apache Traffic Server ATS is a set of scalable HTTP proxy and cache servers from the Apache Foundation. Apache Traffic Server suffers from a cross-site scripting vulnerability that can be exploited by attackers to cause cross-site scripting and cache poisoning attacks...

Apache Zeppelin Cross-Site Scripting Vulnerability (CNVD-2022-89420)

Apache Zeppelin is a Web-based open source notebook application from the Apache Foundation that supports interactive data analysis and collaborative documentation. The application supports interactive data analysis and collaborative documentation. versions of Apache Zeppelin prior to 0.8.2 contai...